Authenticated SSE stream for centralized project log rows

Emits an authoritative project_logs_snapshot with DB revision on open, reconnect, unrecoverable history gaps, model/retention changes, and late arrival. Append revisions emit project_logs_rows deltas; bursts are read in 50-row cursor pages up to the existing stream delivery capacity. The Logs page never requests exact statistics. Authorization renews with a bounded five-minute lease; the stream never polls as a fallback.