fix: use private helcimApiToken for all server-side Helcim API calls

server/api/members/profile.patch.js

@@ -19,6 +19,7 @@ export default defineEventHandler(async (event) => {
     "location",
     "socialLinks",
     "showInDirectory",
+    "notifications",
   ];
 
   // Privacy fields from validated body
@@ -96,6 +97,7 @@ export default defineEventHandler(async (event) => {
       offering: member.offering,
       lookingFor: member.lookingFor,
       showInDirectory: member.showInDirectory,
+      notifications: member.notifications,
     };
   } catch (error) {
     if (error.statusCode) throw error;