Private API: favorite-tags routes

[feruzm]

Four private-api routes for followed hashtags, mirroring the favorites ones in Handlers/Routes.cs and PrivateApi.UserData2.cs. Depends on the onboard side (ecency/onboard favorite-tags routes).

Route	Body	Upstream
POST /private-api/favorite-tags	code	GET favorite-tags/{username} with the query string passed through (pagination)
POST /private-api/favorite-tags-check	code, tag	GET isfavoritetag/{username}/{tag}
POST /private-api/favorite-tags-add	code, tag	POST favorite-tag with {username, tag}
POST /private-api/favorite-tags-delete	code, tag	DELETE favoriteTag/{username}/{tag}

• Username comes from ValidateCode only, never from the body (Notifications handler lets the request body override the authenticated username #90).
• The tag path segment is escaped before it is put in the upstream path (fix(notifications): require a valid code, and escape the upstream path #91).
• Same 401 handling as favorites.