feat(#1): add agent-key authenticated SSE stream /api/agent-events

Per-agent SSE (metadata-only new_message events, id=message_id, 30s heartbeat,
Last-Event-ID replay capped at 200 with resync_required, max 5 connections per
agent, slow clients dropped). Mounted behind the agent API-key middleware.
/api/events is unchanged.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

cmd/synapbus/main.go

@@ -841,6 +841,14 @@ func runServe(cmd *cobra.Command, args []string) error {
 	// Register broadcaster as a message listener so SSE events fire
 	// for messages sent via MCP (agents) as well as the REST API.
 	msgService.AddMessageListener(sseBroadcaster)
+	sseBroadcaster.SetMessageService(msgService)
+
+	// Per-agent SSE stream (agent API key auth, not session auth).
+	sseHub.SetAgentEventBacklog(msgService)
+	r.Group(func(r chi.Router) {
+		r.Use(agents.RequiredAuthMiddlewareWithOAuth(agentService, apiKeyService, oauthProvider))
+		r.Get("/api/agent-events", sseHub.HandleAgentEvents)
+	})
 
 	// Initialize push notification service
 	pushStore := push.NewSQLiteStore(db.DB)