Fix public-only token enforcement for user/org APIs and notifications

[lunny]

• Ensure public-only scoped tokens never return private orgs, repos, activity feeds, or repo-by-id details by enforcing visibility in handlers and routes.
• Add a notifications middleware to block public-only tokens at the router level.
• Add integration tests covering public-only behavior for user/org repos, repo-by-id access, activity feeds, stars, and notifications.

---

Generated by a coding agent with Codex 5.2