feat(apiserver): SSE job-event stream + EventBroker (Phase 2, ADR-004)

Add a Server-Sent Events endpoint /xce/v1/events streaming job lifecycle
events (job.created/updated/deleted/finished) to subscribers. The
DefaultHandler now publishes every job event to a process-wide EventBroker;
the SSE handler subscribes and streams JSON frames with a keep-alive comment
during idle.

- backend/broker.go: thread-safe fan-out Broker (drops for slow consumers so
  the notification path never blocks), Event type with job_status string.
- backend/handler.go: OnJob* publish to DefaultBroker.
- controllers/events.go: SSE handler (gin, text/event-stream, keep-alive).
- router + whitelist + rbac: /xce/v1/events route, event:subscribe
  permission granted to mcp_readonly/mcp_operator/cluster_admin.
- Tests: broker fan-out/slow-consumer/unsubscribe, handler publishes, SSE
  end-to-end via httptest.

Verified live on t1: SSE stream delivered job.updated PEND→RUN events for a
submitted job.

Co-Authored-By: Claude <noreply@anthropic.com>

src/frontend/apiserver/middleware/whitelist.go

@@ -26,6 +26,7 @@ var WhitelistGETURL = []string{
 	"/xce/v1/files/*",                // get download file
 	"/xce/v1/resources/definition",   // resources definition
 	"/xce/v1/resources/distribution", // resources distribution
+	"/xce/v1/events",                 // live job-event SSE stream (scheduler-agent Phase 2)
 	"/xce/v1/roles",                  // roles list
 	"/xce/v1/roles/*",                // role detail
 	"/xce/v1/permissions",            // permissions