feat(dnfs): delegate Token verification to gateway /whoami

Replace the insecure local base64 decode (with FIXME comment about
missing signature verification) with proper remote RSA signature
verification through gateway's /whoami endpoint:

- Add [gateway] config section (url, timeout) to dnfs.ini with defaults.
- Support GATEWAY_URL environment variable override for Docker.
- decode_token() now POSTs to gateway /whoami with Authorization: Bearer
  <token>; gateway verifies RSA signature and expiry, returns login/user/
  is_admin. Network/gateway errors fail-closed with 503.
- Add @_handle_exp decorators to delete_note() and update_note() which
  were missing exception handling wrappers (consistent with other routes).
- docker-compose.yml: add GATEWAY_URL, CONFS_HOST, CONFS_PORT env vars
  plus host.docker.internal extra_hosts so dnfs container can reach
  host-side gateway and confs services.

docker-compose.yml

@@ -83,6 +83,11 @@ services:
       - DB_HOST=db
       - DB_PORT=8005
       - REVIEW_URL=http://ai_review:8007/review
+      - GATEWAY_URL=http://host.docker.internal:8443/whoami
+      - CONFS_HOST=host.docker.internal
+      - CONFS_PORT=8010
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
     depends_on:
       db:
         condition: service_healthy