fix: bound notification publishing on the lifecycle path

[ChiragArora31]

Summary

Related to #1937.

Notification writes are persisted first, then published to live dashboard subscribers. If a publisher stalls, that publish step should not be able to hold the lifecycle path indefinitely after the notification has already been stored.

This change gives notification publishing a bounded window while keeping the existing behavior for successful publishes and fast publisher errors.

What changed

• Add a default publish timeout to the notification manager.
• Allow tests and future callers to override that timeout through manager dependencies.
• Preserve duplicate notification handling as a no-op.
• Cover both fast publisher errors and slow publisher timeout behavior in unit tests.

Verification

• cd backend && go test ./internal/notify
• npm run lint