feat: implement Pact verification for notifications and update CI wor…

[Hunterly01]

Closes #724

Summary

This PR adds a consumer-provider contract for the /notifications API and verifies the live backend handler against it, preventing frontend regressions caused by silent API shape drift.

What changed

• Added/updated the notifications consumer Pact contract in:
  • notifications.consumer.test.ts
• Added provider verification coverage against the live handler in:
  • notifications.pact.test.ts
• Kept the route contract aligned with the live notifications handler in:
  • notifications.ts
• Added the verification script in:
  • package.json
• Wired CI to publish and verify the notifications contract using broker secrets in:
  • ci.yml
• Documented the security and drift-detection behavior in:
  • notifications-pact-contract.md

Why

Frontend regressions repeatedly land when API payloads change without consumer approval. This contract makes response shape changes visible and fails CI when a field is removed or a contract is unexpectedly altered.

Security notes

• Broker credentials are expected via GitHub Actions secrets:
  • PACT_BROKER_URL
  • PACT_BROKER_TOKEN
• Local verification remains available when those secrets are not configured.
• Unauthorized and malformed notification requests remain explicitly covered in the contract.

Validation

I validated the notifications-specific verification path with:

• npx jest --runInBand notifications.test.ts notifications.consumer.test.ts src/routes/notifications.pact.test.ts

Result:

• 3 test suites passed
• 30 tests passed
• 0 failed

[drips-wave]

@Hunterly01 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Hunterly01]

Please merge the issue no error