Add authenticated access boundaries for sensitive API routes

[Noobb-byte]

PR Title

Add authenticated access boundaries for sensitive API routes

Summary

This PR tightens the API boundary around user-specific and operational data by enforcing explicit authentication and authorization checks before requests reach sensitive handlers.

closes #771

Changes

• Hardened bearer-token validation and unsupported environment checks in auth.js
• Applied auth gating to protected routes in server.js
• Added role-based access enforcement for admin-only operational endpoints in accessControl.js and gasPrediction.js
• Added self-or-admin enforcement for user-scoped resources in behavior.js and notificationSummaries.js
• Added regression tests in authBoundary.test.js
• Documented the boundary behavior in README.md

Why

Several routes exposing user or operational data were only partially protected. This change makes the boundary explicit and consistent, preventing unauthorized reads and unsafe config changes while preserving the existing mock OAuth flow used in development/test environments.

[vercel]

Someone is attempting to deploy a commit to the nanle-code's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Noobb-byte Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Manuelshub]

@Noobb-byte Please resolve conflicts so I can merge!!!