Implement NotificationRepository with role-scoped queries

Define `INotificationRepository` as an abstract class first — this enables BLoC/Riverpod layers and tests to depend on the interface, not the concrete Supabase implementation. For role-aware query expansion, prefer a Supabase RPC (stored function) over client-side joins to keep the logic server-side and RLS-safe. The coordinator expansion query should accept `userId` and return the union of the user's own notifications plus those of their managed mentors. Map all `PostgrestException` errors in a `_handleError(Object e)` helper that converts to domain exceptions — this keeps all Supabase-specific error codes in one place.

Use `Notification.fromJson` (from task-003) for row mapping. For Riverpod, expose as a `Provider` overridable in tests. Implement a `const NotificationRepositoryImpl` if no mutable state is needed at construction time.

Two test layers: (1) Unit tests using `flutter_test` with a mocked `SupabaseClient` (via `mockito` or `mocktail`) — verify each method calls the correct Supabase table/RPC with the expected arguments and maps responses to domain objects. (2) Integration tests against a local Supabase instance (Docker) — verify RLS policies are respected, role-expansion returns the correct superset for coordinator, pagination returns correct slices, and error paths (not found, forbidden) throw the expected domain exceptions. Target 90%+ branch coverage on the repository class itself.