SSE stream of Kirbi-driven changes to workflow_id.

Tails agent_workflow_events (populated by the agent runtime when the coordinator's update_workflow tool fires) and pushes one event per row to the client. Authorization is verified once before the stream opens; the client should reconnect if it receives a 401/403.

Polling interval is 750ms by default — cheap on the DB and well below the perceptual threshold for a canvas re-render.