The Discord DM channel's prefs, link-init, and unlink endpoints are
account-level — the handlers only read the user ID — but were mounted
inside the /notifications subrouter, whose RequireProfile middleware
400s any request without an X-Profile-Id header. Register them as
static paths on the auth-only group instead, the same coexistence
pattern the public email-link routes already use (static paths win over
the mounted subrouter's wildcards; verified empirically, no middleware
leak onto profile-scoped routes).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
