fix(#3): uncomment notification test endpoints

[boys-cyberhub]

Closes #3

What changed

backend/src/api/routes.ts:

• Uncommented POST /api/notifications/test (lines 808–910)
• Uncommented POST /api/notifications/test-all (lines 912–998)
• Added blockDebugInProduction middleware to both routes

Why

Both endpoints were fully implemented but wrapped in block comments, causing any call from the documented curl examples or the NotificationTest.tsx frontend component to return 404 Route not found.

The blockDebugInProduction middleware is the existing pattern used by all other test/debug routes (/debug/coingecko-test, /debug/force-fresh-prices, etc.). Applying it here keeps the test endpoints consistent — available in development, blocked in production.

How to test

# 1. Subscribe
curl -X POST http://localhost:3001/api/notifications/subscribe \
  -H "Content-Type: application/json" \
  -d '{"userId": "GABC...", "emailEnabled": true, "emailAddress": "user@example.com", "events": ["rebalance"]}'

# 2. Test single event (was 404, now 200)
curl -X POST http://localhost:3001/api/notifications/test \
  -H "Content-Type: application/json" \
  -d '{"userId": "GABC...", "eventType": "rebalance"}'

# 3. Test all events (was 404, now 200)
curl -X POST http://localhost:3001/api/notifications/test-all \
  -H "Content-Type: application/json" \
  -d '{"userId": "GABC..."}'