Remove bitchat's notifications on panic wipe; drop the unread sender name from DM userInfo

After a panic wipe, Notification Center still lists every bitchat alert, and with previews on each one shows the sender and the message: the data the wipe just deleted. Nothing on main removes them.

What changes

• NotificationService.removeAllDeliveredNotifications() removes bitchat's delivered notifications through a NotificationRemoving seam, shaped like the existing authorizer, deliverer and category-registrar seams, and a no-op under tests.
• panicClearAllData calls it next to the app-switcher snapshot step, before the commit check. So it also runs when the transaction doesn't commit, and when startup resumes an interrupted wipe. It's injected as panicNotificationRemoval, defaulting to the real call.
• DM notifications stop putting the sender's nickname in userInfo. With previews hidden (the default) the alert itself is redacted, but userInfo still handed the nickname to the system, and nothing reads it. docs/privacy-assessment.md already says userInfo carries only the routing peer ID and deep link.
• docs/privacy-assessment.md: the locked-device section says what the removal does and doesn't do, and the panic coverage list gains the entry.

This is removal, not erasure. The system can keep its own record of notifications it has shown, out of the app's reach, so with previews on that record can outlive the wipe. The doc now says so.

Android's panic wipe already does this: panicClearAllData calls clearAllNotifications(), which calls cancelAll().

Tests. Each one fails with its change reverted:

• the removal reaches the notification center, and is skipped under tests;
• the wipe removes notifications on a committed wipe, on one that doesn't commit, and on startup replay when the media wipe throws;
• with previews hidden, userInfo carries only the peer ID.

Full iOS suite green on the simulator (2,072 Swift Testing and 212 XCTest tests), and macOS builds. No new strings.

🤖 Generated with Claude Code