fix(notifications): bind reads to confirmed writes and credentials

[Chris0Jeky]

Closes #3339. Related residual: #3352.

Summary

Binds notification inbox and preference reads to confirmed writes and session lifetimes:

• inbox and preferences have independent latest-read owners;
• mark-one/mark-all and preference updates retire older snapshots through mutation generations;
• loading derives from active operation tokens;
• identity/auth/demo replacement clears both surfaces and retires work;
• same-user token rotation preserves settled inbox/preferences and suppresses old-token settlement;
• an active empty inbox or null preference read restarts under the new token with the exact captured query;
• mark-read, mark-all and preference-update mutations are never replayed.

Mutation serialization, realtime-arrival ordering and reminder/email epic #2010 remain outside this slice.

Test-first evidence

The initial actual-module suite changed from 0/10 passing on main to 10/10 passing after the first ownership correction. Review-regression head 10d48f732725ed8ee9a2557ac39ccf7b7a7958d5 ran canonical Ubuntu/Windows qualification; Ubuntu JUnit recorded 7,161 tests, exactly 4 failures, 0 errors, all loaded-state preservation cases.

Issue #3352 added test-only head 660362c9546b51f9996659be3382ac4b6d67f424, covering token rotation while inbox and preferences are still empty. A dependency-free actual-module runner changed from one call per read API with loading false to two calls per lane with old settlement suppressed and fresh inbox/preferences installed independently.

Supplemental execution does not replace hosted project qualification.

Current head and remaining gates

Exact final head: 4f8134d6c6ecd840041c0127371798e0c412f06a

Keep draft until this exact head passes Smart CI, Extended and the complete Required CI matrix on Ubuntu and Windows, followed by fresh-context review. Stacked preference-order PR #3343 must then be reconciled to this corrected parent and requalified.

This is client-state integrity, not transport cancellation or a server-authorization claim. Green CI is qualification evidence, not merge authorization.

[Chris0Jeky]

Continuation note: keep this PR draft. The current watcher clears notifications/preferences on any token change, but same-user session extension is not a data-identity change. Both active views load only on mount or explicit filter/user action, so token refresh can leave an unchanged route empty or detach the preferences form from its store value.

I recorded the corrected contract on #3339. Add the preservation regression and split token-only owner invalidation from full identity/auth/demo reset before moving this parent to review. Stacked preference-order work should remain behind the corrected parent.