Knock feed 403 under enhanced security: the JWT parser downcases your user id

If Knock's enhanced security gives you a 403 on the feed while your signing code looks correct, compare the exact userid casing on both sides. Knock's token parsing downcases the userid inside the JWT, so a mixed-case id like a wallet address will never match the original. Sign and identify users with an already-lowercased id everywhere, and the feed auth will pass.

Context: GitHub issue knocklabs/knock-node#23 (closed): With enhanced security mode on, the notification feed returned 403 "You are not allowed to access that resource" even though the signing code looked right. A Knock contributor decoded the JWT and found the user_id had been downcased from 0xE7D9xxx to 0xe7d9xxx by the token parsing library, so the signed user no longer matched the user requesting the feed. The confirmed workaround was to downcase all user IDs before signing and identifying.