Public, token-authed follow/sub event feed for the alert overlay.

PER-TOKEN SCOPED, read-only. The path {token} is the ONLY input that selects a user: it is hashed and matched against User.overlay_token_hash server-side, and EVERY query is filtered by PlatformEvent.user_id == that user. There is no parameter (no user_id, no token override) by which the overlay JS could read another user's events; since only filters by time. An unknown/revoked token 404s before any event is read. Same per-IP + per-token rate limit and tier gate as the chat feed.

Initial load (no since) returns an EMPTY list plus a cursor at the latest event (or now), so a freshly-loaded browser source never replays old follows as alerts; subsequent polls pass since and receive only newer events.