Stream mailbox events (server-sent events)

Answers text/event-stream. Without a cursor the stream starts at the present; with since (a cursor from /api/email/changes or the id of any earlier event) it first replays every change after that point, then follows the mailbox journal live: each frame carries the change's type as the event name (message.received, message.updated, message.deleted, message.moved, message.status, mailbox.resync_required, assistant.item.delegated, assistant.item.recalled, ...), the change as JSON data with its resumable cursor, and that same cursor as the frame id. The first frame is ready with the cursor to resume from; a keep-alive comment arrives every 20 seconds; the connection closes after about 5 minutes with a close frame and a retry: hint. Reconnect with Last-Event-ID (or since) to resume with no gap and no duplicate. Agent tokens are confined to the mailboxes the agent operates. An entry about a work item made from authentication mail carries its title and ask redacted for a token without email:auth_secrets.