fix(security): add auth to FCM relay, HMAC to shamcash webhook, fix jwtconnect webhook bypass

backend/ride/firebase/send_fcm.php

@@ -1,7 +1,16 @@
 <?php
-// send_fcm.php - FCM HTTP v1 Sender
+// send_fcm.php - FCM HTTP v1 Sender (Internal use only)
 header('Content-Type: application/json; charset=utf-8');
 
+// 🔐 Require internal API key for authentication
+$apiKey = $_SERVER['HTTP_X_API_KEY'] ?? '';
+$expectedKey = getenv('FCM_INTERNAL_API_KEY');
+if (empty($expectedKey) || !hash_equals($expectedKey, $apiKey)) {
+    http_response_code(403);
+    echo json_encode(['status' => 'error', 'message' => 'Unauthorized']);
+    exit;
+}
+
 $serviceAccountFile = __DIR__ . '/service-account.json';
 
 // السماح فقط بـ POST