Security: Replace inline superuser check with permission-based access control in bulk email endpoint

The **notify_users_about_challenge** endpoint currently relies on inline **request.user.is_superuser** checks for authorization.

This approach is fragile and risks accidental misuse if the view is reused or middleware behavior changes.

Proposed solution:

Use DRF permission classes (e.g. IsAdminUser or a custom permission)

Add endpoint-specific throttling

Add audit logging for bulk email triggers

If this approach is acceptable, I’d be happy to open a PR.

Start at the notify_users_about_challenge endpoint and inspect its current request.user.is_superuser authorization. Review the applicable DRF permission, throttling, and audit-logging patterns, then verify that authorization is permission-based, bulk triggers are throttled, and triggering is audited.

Written by the indexing model from the issue text.