Client-side controller

This is a fairly sizable refactoring of our client code. I've created a new controller that listens for messages, makes API requests, and updates state. Everywhere that components were sending API calls and updating state themselves, they not dispatch a message to the controller which does it for them.
We should remove the single `read` notification action from the server.