Phase C: catalog SSE invalidation feed + browser subscription/resync

[brylie]

Implements workspace-sharding.md §4's SSE contract, building on Phase A's
catalog_outbox table (schema exists, has status states pending_content →
content_durable → publishable → published, but no consumer yet) and
Phase B's real shard split.

• SSE endpoint draining publishable catalog_outbox rows, scoped to an
  authorized Workspace + set of Spaces (never revealing an
  inaccessible title/hierarchy/existence signal).
• Opaque Last-Event-ID cursor handling; catalog-resync on scope change,
  cursor gap, or ambiguous replay coverage.
• Browser client subscribes and treats each event as a hint to refetch
  authoritative catalog state, never mutating its cache from the event
  payload directly.

Not in scope: lazy load/unload (Phase D), capacity benchmark (Phase E).

Done when: a Space-scoped SSE subscriber never receives an event revealing
inaccessible state, a missed event causes a revision-aware resync (not a
stale UI), and the sidebar updates live off SSE instead of only off direct
Yjs Awareness/doc observation.

[brylie]

Set Priority: unset → P1: depends on this issue's shard split (#120, P0) landing first — the catalog_outbox table Phase A already built has no cross-shard operation to actually stage yet. Sequenced after #120, before #122.

[brylie]

Blocked by #120 (Phase B): the catalog_outbox table Phase A built has pending_content/content_durable/publishable states with no producer yet — those only exist once #120's real cross-shard operations (move/delete spanning shards) do. Blocking #122 (Phase D).