feat(auth): require Endorser verification on device registration

Gate /notifications/register on Endorser JWT acceptance while leaving the local testMode bypass unchanged.

src/routes/notifications.ts

@@ -1,6 +1,7 @@
 import express, { Router } from "express";
 import { db } from "../db/fcmTokens.js";
 import { requireAuthOrNotificationLocalTest } from "../middleware/auth.js";
+import { checkAuth } from "../services/endorserClient.js";
 import { errorMessage, formatElapsedMs } from "../util/formatElapsed.js";
 import { maskToken } from "../util/maskToken.js";
 
@@ -95,6 +96,23 @@ notificationsRouter.post(
       return;
     }
 
+    // Local test bypass leaves req.jwt unset; only Endorser-check authenticated requests.
+    const jwt = req.jwt;
+    if (jwt !== undefined) {
+      const endorsed = await checkAuth(jwt);
+      if (!endorsed) {
+        console.log(
+          "[Register] Endorser verification failed in",
+          formatElapsedMs(Date.now() - started)
+        );
+        res.status(401).json({
+          success: false,
+          message: "Unauthorized",
+        });
+        return;
+      }
+    }
+
     if (
       req.body !== null &&
       typeof req.body === "object" &&