fix: eliminate $_SESSION drift in SessionProvider and add notification UI states

Pass AppContainer to SessionProvider::clear() so all module providers use
SessionStoreInterface consistently instead of raw $_SESSION. Also add
loading and error states to the notification bell dropdown (GR-UI-014).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/App/Module/Contracts/SessionProvider.php

@@ -22,5 +22,5 @@ interface SessionProvider
     /**
      * Remove session keys owned by this module (called on logout).
      */
-    public function clear(): void;
+    public function clear(AppContainer $container): void;
 }