Add authorization policy and tests for notifications

[rsmithlal]

Summary

• add NotificationsPolicy to restrict notifications access
• authorize notifications actions and handle Pundit errors
• test that unauthorized users are redirected from notifications endpoints

Testing

• bundle exec rubocop
• bundle exec brakeman -q -w2
• bundle exec bundler-audit --update
• bin/codex_style_guard
• bin/ci (fails: connection to server at "::1", port 5432 failed: fe_sendauth: no password supplied)

---

https://chatgpt.com/codex/tasks/task_e_689a559cd1d883218d1410e9a904da5a