fix(push): give the subscription removal a five-second limit

Sign-out removes the push row first, through the raw fetch helper, which
has no default timeout. On a connection that is up but carries nothing,
the sign-out waited for the browser's own timeout before the logout
request even started. The removal now gives up after five seconds.

src/hooks/__tests__/use-logout.test.ts

@@ -137,6 +137,8 @@ describe("useLogout", () => {
     expect(JSON.parse(String(deleteCall[1]?.body))).toEqual({
       endpoint: subscription.endpoint,
     });
+    // A connection that carries nothing must not hold the sign-out.
+    expect(deleteCall[1]?.signal).toBeInstanceOf(AbortSignal);
     expect(replace).toHaveBeenCalledWith("/auth/login");
   });
 

src/lib/notifications/web-push-subscription.ts

@@ -9,11 +9,16 @@ async function browserSubscription(): Promise<PushSubscription | null> {
   return (await registration?.pushManager.getSubscription()) ?? null;
 }
 
+/**
+ * Bounded: on a connection that is up but carries nothing, sign-out would
+ * otherwise wait out the browser's own timeout before it even starts.
+ */
 function deleteServerRow(subscription: PushSubscription): Promise<Response> {
   return apiFetchRaw("/api/notifications/web-push", {
     method: "DELETE",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({ endpoint: subscription.endpoint }),
+    signal: AbortSignal.timeout(5_000),
   });
 }