fix: only set notificationToken after successful backend registration
Greptile flagged that enableWebNotifications committed the subscription
token to the store before the POST /api/notification call, and never
checked the response status. A network hiccup or server error after
PushManager.subscribe() left the toggle showing "on" while the server
had no subscription row — the user believed they were subscribed when
they weren't.
Now the token is only set after a confirmed successful POST (res.ok
check), mirroring the disableWebNotifications fix from the earlier
review pass. On failure the catch block returns "denied" so the toggle
stays honest and the user can retry.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>