My example here EventSub WebSockets with Implicit Auth Example is working as expected.
So it’s not a Twitch Side issue per sae.
So I can’t see anything wrong with what you have said is your order of operations.
The only thing I can think of is that your POST request to make a subscription. Is malformed. You declared a ContentType header of JSON but the message is not quite built nicely perhaps?
Not sure since this is just a Curl log. Are you just building command line CURL requests or a language to make HTTP calls?