Subscribe to the live event stream (SSE)

Consumes a ticket from POST /api/v1/events/ticket and upgrades the HTTP response to an SSE stream (text/event-stream). Each frame is a JSON envelope with type, monitor_id, occurred_at, and a type-specific data payload. See docs/SSE_LIVE_UPDATES_SPEC.md for the four event types and their payloads. Heartbeat comments (: heartbeat) are emitted every 25 seconds.

Credential re-checked at open AND periodically while connected (issue #339). A ticket's bound credential — the account, the minting user, and the API key if one was presented — is re-verified against durable storage both when the ticket is redeemed and, once the stream is open, every ~30 seconds thereafter. Removing the minting user from the account, revoking the API key past its grace window, or suspending the account closes an already-open stream within roughly 45 seconds on a healthy connection (a 30s recheck interval + 5s check timeout detects the revocation and cancels the stream in ~35s, plus up to a further 10s write deadline for an in-flight write/flush to unblock and the stream to actually close) — not instantly, and not a hard worst case: the write deadline is armed only for the duration of a write+flush and cleared between frames, so it bounds the handler's own blocking, not a stalled HTTP/2 connection writer. A transient failure (e.g. a database hiccup) never closes an open stream on its own; it only delays how soon a genuine revocation takes effect.