feat(route/substack): authenticated post bodies and Notes feed

### What feature is it?

Enhance the existing Substack integration with optional authenticated post retrieval and a Notes route:

- Let `/substack/subscribe/:user` fetch each post from Substack's post API so the feed contains the body available to the requester.
- Add an optional `SUBSTACK_COOKIE` for trusted self-hosted instances. Paid bodies must only be returned when that Substack account already has access.
- Add `/substack/notes/:user` to expose Notes/activity published by the publication's primary author, because the publication `/feed` contains posts but not Notes.
- Keep caches separated by authentication context.

This is authenticated access, not a paywall bypass.

### What problem does this feature solve?

Substack's native publication feed may contain only a preview for paid posts and does not include the author's Notes. As a result, the current RSSHub route cannot provide the complete content visible to a logged-in subscriber and cannot subscribe to publication Notes at all.

### Additional description

One possible implementation flow is:

1. Parse the publication feed for post metadata.
2. Fetch `/api/v1/posts/:slug` with the optional authenticated session and build the item from the returned post body.
3. Resolve the publication's primary profile, then read the profile activity feed filtered to Notes for `/substack/notes/:user`.
4. Hash the authentication context into cache keys so anonymous previews cannot poison authenticated results.
5. Fall back to the native feed item if an individual post API request fails.

Example publication: https://norsemanmarkettiming.substack.com/.

The existing Substack issues and PRs found in search concern XML parsing or trending posts, not authenticated bodies or Notes.

### This is not a duplicated feature request or new RSS proposal

- [x] I have searched [existing issues](https://github.com/DIYgod/RSSHub/issues) to ensure this feature has not already been requested and this is not a [new RSS proposal](https://github.com/DIYgod/RSSHub/issues/new?assignees=&labels=RSS+proposal&template=rss_request_en.yml).

Start by locating the existing Substack subscribe route and its publication feed parsing. Trace how post metadata and cache keys are built, then review the Substack post API and profile activity flow described in the issue. Done means authenticated users receive accessible post bodies, the notes route exposes author Notes, authentication contexts have separate caches, and failed API requests fall back to feed items.

Written by the indexing model from the issue text.