fix: address all PR review comments

- HTTPClient: replace isRefreshing bool with shared Task to safely
  coalesce concurrent 401 refresh attempts; surface JSON serialization
  error instead of silently dropping request body
- AuthService.logout: always clear Keychain tokens via defer, even when
  refresh token is absent, preventing stale access token
- NotificationsAPIService: remove updateAppBadge (UIKit call moved to
  @MainActor NotificationsViewModel); drop unused UIKit import
- NotificationsViewModel: guard startPolling() against duplicate tasks;
  update badge directly on @MainActor instead of hopping to actor
- VerifyEmailView: replace Timer (never invalidated) with async Task
  cancelled in .onDisappear
- NotificationsView: use Text(date, style: .relative) — auto-updates
  without custom formatter; remove duplicate Date extension
- SettingsView: handle logoutAll errors explicitly with alert instead of
  silently proceeding with local logout
- MaydayLiveActivity/Info.plist: add NSExtensionPrincipalClass so the
  widget extension is discoverable by the system
- Live Activity widget: replace frozen duration(from:) with
  Text(date, style: .timer); replace frozen relativeFormatted with
  Text(date, style: .relative); localize status badge to Russian

Co-authored-by: robonen <26167508+robonen@users.noreply.github.com>

Mayday/Services/AuthService.swift

@@ -52,9 +52,11 @@ actor AuthService {
     }
 
     func logout() async throws {
+        // Always clear local tokens, regardless of whether the network call succeeds,
+        // to avoid leaving a stale access token in Keychain.
+        defer { keychain.clearTokens() }
         guard let refreshToken = keychain.loadRefreshToken() else { return }
         let _: EmptyResponse = try await client.request(.logout(refreshToken: refreshToken))
-        keychain.clearTokens()
     }
 
     func getMe() async throws -> UserResponse {