fix(notifications): wait for auth before fetching notifications (#135)

The notifications page called getAccessToken() immediately on mount,
before the AuthProvider's silent refresh completed. This sent an empty
Bearer token, causing a 401 that displayed as "Failed to load
notifications." Wrap in ProtectedRoute and gate fetch on auth loading.