Reject null origins on SSE events endpoint

[0x4D31]

Summary

• stop accepting Origin: null on the SSE events handler so only same-host origins are permitted
• keep the focused CORS tests that cover matching and disallowed origins without null-specific cases

Testing

• go test ./internal/sse -count=1

---

https://chatgpt.com/codex/tasks/task_e_690a210f9db4833180f282f400d90b67