Add Bearer JWT auth middleware for notification routes

Mirror image-api’s DID JWT verification (src/vc + requireAuth) so
/notifications/* require a valid Authorization header while /health
stays public. Attach req.did, req.jwt, and req.auth for downstream use.

package.json

@@ -9,6 +9,11 @@
     "build": "tsc"
   },
   "dependencies": {
+    "@peculiar/asn1-ecc": "^2.3.8",
+    "@peculiar/asn1-schema": "^2.3.8",
+    "cbor-x": "^1.5.9",
+    "did-jwt": "^7.4.7",
+    "did-resolver": "^4.1.0",
     "express": "^5.1.0",
     "firebase-admin": "^13.9.0"
   },