Resolves #1883: Fixing hung sessions

[david-rocca]

Closes #1883

Summary

Fixes controller paths that created Mongoose sessions before validation or returned from active transactions without aborting. Adds regression coverage for invalid and unauthorized-style early-return paths.

Important Changes

src/controller/audit.controller/audit.controller.js

• Moved request validation before session creation for audit create, append, document lookup, org lookup, and last-change lookup paths.

src/controller/registry-user.controller/registry-user.controller.js

• Deferred session creation until after preflight validation and authorization checks.
• Added missing transaction abort before role-validation early returns.

src/controller/review-object.controller/review-object.controller.js

• Moved org body validation before session creation where possible.
• Kept reject authorization inside the managed transaction/session lifetime.

src/controller/org.controller/org.controller.js

• Added missing transaction aborts before early returns in update/create-user paths.
• Avoids unnecessary session creation for create preflight validation.

src/controller/registry-org.controller/registry-org.controller.js

• Avoids unnecessary session creation in create org/user preflight failures.
• Added missing transaction abort for role validation failure.

src/controller/conversation.controller/conversation.controller.js

• Added missing transaction aborts before validation and authorization early returns.

test/unit-tests/controllerSessionCleanupTest.js

• Added focused session cleanup regression tests for audit, registry-user, review-object, org, registry-org, and conversation controllers.