Beneficiary profile + KYC submission flow

[Martins0152]

Description
Implement beneficiary profile creation and the KYC submission endpoints (POST /:id/kyc, PATCH /kyc/:submissionId/review) using the Beneficiary and KycSubmission models.

Acceptance Criteria

• A user can create exactly one beneficiary profile (GET /my-profile returns it).
• POST /:id/kyc accepts a document type + document URL, creates a KycSubmission with status PENDING, and does not auto-approve.
• PATCH /kyc/:submissionId/review is restricted to ADMIN/ORGANIZATION and requires an approve/reject decision plus optional notes.
• On approval, the beneficiary's kycStatus updates to VERIFIED; on rejection, to REJECTED, and a notification is queued (stub acceptable if notifications aren't done yet - leave a TODO).
• Tests cover submission, approval, and rejection paths.
• Documented in openapi.yaml.

Suggested reward: $25-$35