Change hints for live tables (Server-Sent Events)

tenant-live-changes. text/event-stream of change hints for the named live tables of the key's project: ready (cursor), change (id = hint cursor; data = { table, op, pk: [<primary key objects>] | null, n }, never row data), resync ({ tables, reason } — refetch what you care about), reconnect (the server closes every stream after 300 s; reconnect with Last-Event-ID). A comment heartbeat every 15 s. Audience follows the token: apikey: <anon_key> is the anonymous audience (public-policy tables only), + Authorization: Bearer <access_token> the user audience (its own user_owns_rows hints), apikey: <service_key> sees every hint. A table without live: true is 403 TABLE_NOT_LIVE before any event; an owner-scoped table without an identity is 401 AUTH_REQUIRED; over the per-project (200; 50 on prototype) or per-task cap is 429 LIVE_CONNECTION_LIMIT with Retry-After. The same stream is served on every tenant host at /_run402/live?tables= (no key: the host's own project; a hosted-auth session cookie or user Bearer selects the user audience).