Restrict SSE events endpoint to trusted origins

[0x4D31]

Summary

• restrict the SSE events handler to only allow requests from matching or null origins
• return 403 for disallowed origins to avoid leaking events to arbitrary websites
• add unit tests covering the new CORS logic

Testing

• go test ./internal/sse -count=1

---

https://chatgpt.com/codex/tasks/task_e_690a210f9db4833180f282f400d90b67