fix: eliminate $_SESSION drift in SessionProvider and add notification UI states

Pass AppContainer to SessionProvider::clear() so all module providers use
SessionStoreInterface consistently instead of raw $_SESSION. Also add
loading and error states to the notification bell dropdown (GR-UI-014).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/Service/Auth/AuthSessionTenantContextService.php

@@ -54,7 +54,7 @@ class AuthSessionTenantContextService
     public function clearModuleSessionData(): void
     {
         foreach ($this->moduleSessionProviders() as $provider) {
-            $provider->clear();
+            $provider->clear($this->container);
         }
     }