feat(apiserver): SSE job-event stream + EventBroker (Phase 2, ADR-004)

Add a Server-Sent Events endpoint /xce/v1/events streaming job lifecycle
events (job.created/updated/deleted/finished) to subscribers. The
DefaultHandler now publishes every job event to a process-wide EventBroker;
the SSE handler subscribes and streams JSON frames with a keep-alive comment
during idle.

- backend/broker.go: thread-safe fan-out Broker (drops for slow consumers so
  the notification path never blocks), Event type with job_status string.
- backend/handler.go: OnJob* publish to DefaultBroker.
- controllers/events.go: SSE handler (gin, text/event-stream, keep-alive).
- router + whitelist + rbac: /xce/v1/events route, event:subscribe
  permission granted to mcp_readonly/mcp_operator/cluster_admin.
- Tests: broker fan-out/slow-consumer/unsubscribe, handler publishes, SSE
  end-to-end via httptest.

Verified live on t1: SSE stream delivered job.updated PEND→RUN events for a
submitted job.

Co-Authored-By: Claude <noreply@anthropic.com>

src/frontend/apiserver/router/routers.go

@@ -144,6 +144,15 @@ func Router() *gin.Engine {
 		jobsApi.POST("/:jobids/restart", controllers.RequirePermission("queue:submit"), jobHandler.RestartJobByID)
 	}
 
+	// ################ case: events route (scheduler-agent Phase 2, ADR-004)
+	eventsApi := r.Group("/xce/v1/events")
+	{
+		eventsHandler := &controllers.EventsController{}
+		// Server-Sent Events stream of job lifecycle events. Long-lived
+		// connection; keep-alive comments are sent when idle.
+		eventsApi.GET("", controllers.RequirePermission("event:subscribe"), eventsHandler.SubscribeJobs)
+	}
+
 	// ################ case: resources route
 	resApi := r.Group("/xce/v1/resources")
 	{