Implement session lifecycle hooks in TabStateManager

Use `ref.listen(authStateProvider, (previous, next) { ... })` inside `build()` to subscribe to auth changes — this is automatically disposed when the provider is disposed. For `AppLifecycleState`, use `AppLifecycleListener(onResume: _onResume)` registered in `build()` and disposed in `ref.onDispose(() => _lifecycleListener.dispose())`. Staleness check: store a `DateTime _lastMutatedAt` field in the notifier and compare on resume.

The 5-minute threshold should be a named constant `_staleThreshold = Duration(minutes: 5)`. For the logout/role-switch reset, use a single `_resetState()` private method that calls `clearAll` and then `state = AsyncData(_defaultTabState)` — reuse this for both triggers. The BankID and Vipps logout paths must go through the same auth provider so the stream emits correctly — coordinate with the auth epic to ensure this contract. Do not call `GoRouter.go()` from the notifier — let the shell widget observe `activeTabIndex` via `ref.watch` and call `shellNavigator.goBranch(0)` reactively.

Unit tests in `test/navigation/tab_state_manager_lifecycle_test.dart` using `ProviderContainer` with fake providers: (1) Emit `AppLifecycleState.resumed` with stale timestamp (> 5 min) — assert repository read was called and state was refreshed. (2) Emit `AppLifecycleState.resumed` with fresh timestamp (< 5 min) — assert repository read was NOT called. (3) Emit logout auth event — assert `repository.clearAll()` called and `state.activeTabIndex == 0` and all snapshots are empty. (4) Emit role-switch auth event — assert same clearAll + reset behavior as logout.

(5) Dispose the notifier — assert no further events are processed after disposal (subscription leak test using a broadcast stream controller). (6) Emit logout during active `updateStackSnapshot` call — assert final state is the reset state, not a race-condition hybrid. Target: 90%+ line coverage, all race conditions tested.