Adds optional SSE notifications for live query and carve updates

[javuto]

Summary

Adds optional SSE notifications for live query and carve updates. REST remains authoritative, and existing polling continues as fallback.

• Distributes notifications across API/TLS replicas through Redis Pub/Sub.
• Enforces environment permissions and revalidates authentication on open streams.
• Bounds queues and connections, with reconnect recovery and shutdown cleanup.
• Shares frontend subscriptions and refreshes only affected query caches.
• Adds configuration, documentation, OpenAPI definitions, and regression tests.

Disabled by default. Enable --events-enabled on API and TLS with the same deployment-specific --events-namespace.

Validation

• Full Go test suite
• 407 frontend tests
• TypeScript checking and production frontend build
• Focused race checks
• Redis fan-out, namespace isolation, and reconnect tests
• OpenAPI consistency check

Follow-up

Result-readiness guarantees, reduced polling, console/file-explorer integration, browser E2E, and load testing remain pending.