feat(reports): notification bell consumes report.ready (B3c)

[remyluslosius]

Summary

Phase B3c turns the stubbed TopBar bell into a real, working notification surface driven by the report.ready event (#646's producer). This completes Phase B: the operator who generates a Framework Attestation is now notified in-app when its bulk faces finish rendering.

What changes

• useNotificationStore (new): a small Zustand store with a session-scoped unreadReports counter + bumpReportReady / clearReports actions — the shared state between the SSE handler (producer) and the bell (consumer). No server data, not persisted.
• useLiveEvents: subscribes to the report.ready topic; the handler bumps the unread counter and invalidates ['reports'] so the library refreshes. A report is fleet-scoped, so no ['host', id] invalidation.
• TopBar NotificationBell: was a disabled "coming soon" stub; now an enabled control that renders the unread count as a badge (only when > 0) and, on click, clears the counter and navigates to /reports.

Scope (deliberately small and honest)

The counter is session-scoped (a refresh resets it), there is no dropdown feed of individual notifications, and report.ready is the only event type. A durable per-user feed (a dropdown list, multiple event types, cross-session persistence) is the deferred follow-on and is not faked here — the bell shows a truthful count of report.ready events received this session.

This is the conservative MVP of the product-sensitive slice I flagged earlier. The data-model-free scoping keeps it low-risk and easy to extend; richer notification UX is a clean follow-up.

Spec / tests

• frontend-live-events v1.3.0: C-08 + AC-10 (report.ready → bell bump + ['reports'] invalidation, no host invalidation; AC-01 updated to the 7-topic closed set).
• frontend-notifications v1.0.0 (new, registered in specter.yaml): C-01/C-02 + AC-01/AC-02 over the store + the bell (source inspection).
• tsc / eslint / prettier clean; full frontend vitest suite 333 passed; specter check 112 specs structural + structural coverage 100%.

Validation

• tsc / eslint / prettier
• full vitest suite (333 passed)
• specter check + structural coverage (100%)