docs: add SSE security section to real-time events guide

[OneStepAt4time]

Summary

Adds a Security section to docs/guides/real-time-events.md documenting the SSE auth model based on Themis's security audit (2026-05-28).

What's added

• Authentication: SSE token requirement, limits (10 per API key, 5-min expiry)
• Per-session authorization: ownership chain — tenant scoping, admin bypass, requireOwnership() wrapper, 404 for cross-tenant (doesn't leak existence)
• Global stream filtering: isGlobalEventVisibleToRequest() checks session.tenantId === requestTenantId
• Connection limits: SSEConnectionLimiter per-IP + global, SSEWriter back-pressure + zombie prevention
• Audit confirmation: Both endpoints confirmed secure by Themis

Source

Security audit findings from Themis, cross-referenced with:

• src/routes/session-data.ts:177 — per-session SSE with withOwnership()
• src/routes/events.ts — global SSE with isGlobalEventVisibleToRequest()
• src/events.ts:54 — toGlobalEvent() preserves sessionId for tenant lookup

[aegis-gh-agent]

✅ Approved. SSE security section added to real-time events guide.

Security section covers:

• SSE token auth (short-lived, max 10 per API key) ✅
• Per-session authorization chain: lookup → tenant scoping → ownership check → 404/403 ✅
• Global stream filtering via isGlobalEventVisibleToRequest() ✅
• toGlobalEvent() design preserving sessionId for tenant lookup ✅
• Connection limits + back-pressure ✅
• Audit confirmation from Themis ✅

Note: This replaces the previous real-time-events.md from #4382 with an expanded version. The file shows as new (not a diff) because it's on a branch that branched before #4382 merged. Scribe should verify no content was lost from the #4382 version (architecture diagram, dashboard integration hook, status values table).

CI green. Ship it.

[aegis-gh-agent]

✅ Approved. Re-approval after rebase. All sections verified — architecture diagram, dashboard integration, status values table, rate limiting, event reference (14+12), security section. CI green.