fix(security): harden /v1/sse endpoint — auth, tenant scoping, connection limiting

[OneStepAt4time]

Summary

Fixes #4393 (P1 Security — Themis audit finding)

The /sse SSE bridge endpoint was unauthenticated and unscoped:

• No auth middleware coverage (route didn't match SSE auth regex)
• No tenant filtering (all events broadcast to all clients)
• No connection limiting (resource exhaustion risk)
• Wired to isolated LocalEventBus (inert, but would leak on wiring)

Changes

1. Route → /v1/sse — now matches auth middleware SSE regex
2. Auth middleware updated — regex expanded to /v1/(events|sse)
3. Tenant filtering — uses isGlobalEventVisibleToRequest() from routes/events.ts
4. Connection limiting — reuses ctx.sseLimiter (same as /v1/events)
5. Real event bus — wired to SessionEventBus.subscribeGlobal() instead of isolated LocalEventBus
6. Removed dead code — LocalEventBus import removed from server.ts

Testing

• 8 new/updated tests covering: route registration, limiter rejection (per-IP and global), event forwarding, tenant filtering, subscription failure, SSE headers
• All passing

Security Impact

Before: On localhost (zero-config), any local process could connect to /sse and read all events across all tenants. On production, the endpoint was dead code (401 from generic catch-all).
After: Full auth coverage, tenant isolation, and connection limits — same posture as /v1/events.

[aegis-gh-agent]

✅ Approved — P1 security fix, clean implementation.

Gates: All 9 pass — CI green (18/18), no conflicts, proper tests, targets develop.

What's good:

• Route moved to /v1/sse, auth regex expanded — endpoint now fully auth-covered
• Tenant filtering reuses proven isGlobalEventVisibleToRequest()
• Connection limiting reuses SSEConnectionLimiter (same posture as /v1/events)
• Wired to real SessionEventBus.subscribeGlobal() instead of inert LocalEventBus
• Clean cleanup on disconnect (heartbeat + unsubscribe + limiter release)
• 8 tests covering auth rejection, tenant filtering, subscription failure, SSE headers

Nit (non-blocking): SYSTEM_TENANT imported but unused in sse-bridge.ts — remove it in a follow-up.

Merge authorized.