Implement Passkey Expiry Notification Delivery Confirmation

[maugauwi-hash]

Labels: bug, ttl-vault, api-server
Priority: Medium
Estimated Time: 1.5 hours

Description:
passkey_expiry_notification_tests.rs and docs/passkeys.md cover expiry notifications, but there's no confirmation the off-chain notification path (via backend/src/notifications.rs) actually delivers before the passkey expires, versus just emitting an on-chain event.

Tasks:

• Add a delivery-confirmation callback from the notification service back to tracked state
• Retry notification delivery on failure before the expiry deadline
• Add tests for successful delivery and delivery-failure-then-retry
• Document the end-to-end notification guarantee in docs/passkeys.md