phase 2 (part 4): SSE stream via io.Pipe, OIDC JWT auth middleware

- SSE stream: GET /events/stream using io.Pipe to bridge the SSE
  goroutine to the response body. Replay from Last-Event-ID via
  in-memory broker with DB fallback. LISTEN/NOTIFY fan-out to all
  subscribers. Heartbeat every 15s. Bounded channels.
- OIDC JWT auth: validates Bearer tokens against Authentik/OIDC
  issuer via JWKS discovery + key caching. Extracts sub/email into
  context actor. Falls back to static bearer tokens. Dev mode (no
  OIDC + no tokens) = open.
- Config: OIDCIssuer, OIDCClientID env vars
- SSE + OIDC infrastructure complete, build passes, all tests pass

Remaining: MCP server, conformance tests, wire audit middleware

internal/domain/errors.go

@@ -18,4 +18,5 @@ var (
 	ErrAlreadyExists     = errors.New("entity already exists")
 	ErrQuarantined       = errors.New("pattern is quarantined")
 	ErrSkillDeprecated   = errors.New("skill is deprecated")
+	ErrInvalidInput      = errors.New("invalid input")
 )