feat: implement full FCM token cleanup on logout by deleting both remote and local tokens

lib/core/services/push_notification_service.dart

@@ -254,16 +254,26 @@ class PushNotificationService {
     _dispatchTap(Map<String, dynamic>.from(message.data));
   }
 
-  /// Unregister FCM token from backend (call on logout).
+  /// Unregister FCM token from backend and delete locally (call on logout).
   Future<void> unregister() async {
-    if (_currentToken == null) return;
+    // Remove from backend so it stops sending push to this device
+    if (_currentToken != null) {
       try {
         await _repo.removeFcmToken(_currentToken!);
         debugPrint('[FCM] Token unregistered from backend');
       } catch (e) {
         debugPrint('[FCM] Failed to unregister token: $e');
       }
+    }
     _currentToken = null;
+
+    // Delete the local FCM token so Firebase stops delivering notifications
+    try {
+      await _messaging?.deleteToken();
+      debugPrint('[FCM] Local FCM token deleted');
+    } catch (e) {
+      debugPrint('[FCM] Failed to delete local token: $e');
+    }
   }
 
   /// Re-register token after login.

lib/features/auth/presentation/providers/auth_provider.dart

@@ -78,6 +78,8 @@ class AuthNotifier extends StateNotifier<AuthState> {
     // when token refresh fails
     ApiClient.onForceLogout = () {
       SocketService().disconnect();
+      // Delete local FCM token so push notifications stop
+      PushNotificationService().unregister();
       // Only reset if still authenticated — avoid showing errors on login screen
       if (state.status == AuthStatus.authenticated) {
         state = const AuthState();
@@ -121,12 +123,13 @@ class AuthNotifier extends StateNotifier<AuthState> {
     state = const AuthState();
     // Disconnect socket immediately
     SocketService().disconnect();
-    // Clear tokens BEFORE any API calls to prevent 401 errors during logout
+    // Unregister FCM BEFORE clearing tokens — backend call needs auth header,
-    await SecureStorage.clearTokens();
+    // and deleteToken() stops Firebase from delivering to this device
-    // Best-effort cleanup — tokens already cleared, ignore any errors
     try {
       await PushNotificationService().unregister();
     } catch (_) {}
+    // Logout API call + clear local tokens
+    await _repository.logout();
   }
 
   Future<void> login({