fix: eliminate $_SESSION drift in SessionProvider and add notification UI states

Pass AppContainer to SessionProvider::clear() so all module providers use
SessionStoreInterface consistently instead of raw $_SESSION. Also add
loading and error states to the notification bell dropdown (GR-UI-014).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/Service/Auth/AuthSessionTenantContextServiceTest.php

@@ -144,7 +144,7 @@ final class DummyAuthSessionProvider implements SessionProvider
         $_SESSION['dummy_provider_user_id'] = (int) ($user['id'] ?? 0);
     }
 
-    public function clear(): void
+    public function clear(AppContainer $container): void
     {
         self::$clearCalls++;
         unset($_SESSION['dummy_provider_user_id']);