feat(route/substack): authenticated post bodies and Notes feed

What feature is it?

Enhance the existing Substack integration with optional authenticated post retrieval and a Notes route:

• Let /substack/subscribe/:user fetch each post from Substack's post API so the feed contains the body available to the requester.
• Add an optional SUBSTACK_COOKIE for trusted self-hosted instances. Paid bodies must only be returned when that Substack account already has access.
• Add /substack/notes/:user to expose Notes/activity published by the publication's primary author, because the publication /feed contains posts but not Notes.
• Keep caches separated by authentication context.

This is authenticated access, not a paywall bypass.

What problem does this feature solve?

Substack's native publication feed may contain only a preview for paid posts and does not include the author's Notes. As a result, the current RSSHub route cannot provide the complete content visible to a logged-in subscriber and cannot subscribe to publication Notes at all.

Additional description

One possible implementation flow is:

1. Parse the publication feed for post metadata.
2. Fetch /api/v1/posts/:slug with the optional authenticated session and build the item from the returned post body.
3. Resolve the publication's primary profile, then read the profile activity feed filtered to Notes for /substack/notes/:user.
4. Hash the authentication context into cache keys so anonymous previews cannot poison authenticated results.
5. Fall back to the native feed item if an individual post API request fails.

Example publication: https://norsemanmarkettiming.substack.com/.

The existing Substack issues and PRs found in search concern XML parsing or trending posts, not authenticated bodies or Notes.

This is not a duplicated feature request or new RSS proposal

• I have searched existing issues to ensure this feature has not already been requested and this is not a new RSS proposal.