fix(sse): Fix critical SSE auth and URL issues

1. Fix SSE URL mismatch (CRITICAL):
   - Frontend was connecting to /events instead of /events/stream
   - Updated useProjectEvents.ts to use correct endpoint path

2. Fix SSE token authentication (CRITICAL):
   - EventSource API doesn't support custom headers
   - Added get_current_user_sse dependency that accepts tokens from:
     - Authorization header (preferred, for non-EventSource clients)
     - Query parameter 'token' (fallback for browser EventSource)
   - Updated SSE endpoint to use new auth dependency
   - Both auth methods now work correctly

Files changed:
- backend/app/api/dependencies/auth.py: +80 lines (new SSE auth)
- backend/app/api/routes/events.py: +23 lines (query param support)
- frontend/src/lib/hooks/useProjectEvents.ts: +5 lines (URL fix)

All 20 backend SSE tests pass.
All 17 frontend useProjectEvents tests pass.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

frontend/src/lib/hooks/useProjectEvents.ts

@@ -258,10 +258,11 @@ export function useProjectEvents(
 
     // Build SSE URL with auth token
     const baseUrl = config.api.url;
-    const sseUrl = `${baseUrl}/api/v1/projects/${projectId}/events`;
+    // Backend SSE endpoint is at /events/stream (not /events)
+    const sseUrl = `${baseUrl}/api/v1/projects/${projectId}/events/stream`;
 
     // Note: EventSource doesn't support custom headers natively
-    // We pass the token as a query parameter (backend should validate this)
+    // Backend SSE endpoint accepts token as query parameter for EventSource compatibility
     const urlWithAuth = `${sseUrl}?token=${encodeURIComponent(accessToken)}`;
 
     try {