Close remote dashboard SSE streams when pairing authorization ends

[aebrer]

Summary

An already-authenticated remote dashboard SSE connection is not closed when its device pairing expires or is subsequently unpaired.

This is a narrow session-revocation hardening gap, not continued terminal-equivalent access:

• The device must have opened the SSE stream while legitimately paired.
• The existing one-way stream may continue receiving dashboard events while that connection remains alive.
• New API requests and SSE reconnections are authenticated normally and are denied after expiry or unpairing.
• Disconnecting the tab/network, browser suspension, or restarting the dashboard ends the exposure.

This was identified during review of PR 455 and deferred because it predates that PR and is outside issues 446/449.

Current behavior

Authentication middleware checks /api/events when the request opens. Heartbeats and later event writes do not revalidate the pairing, and unpairing a device has no integration with active SSE connections.

Desired behavior

Close an established remote SSE stream when its pairing authorization ends, without changing local-dashboard behavior or the existing authentication applied to new requests.

Acceptance criteria

• A remote SSE connection closes when its pairing reaches its recorded expiresAt.
• Unpairing a device closes any active SSE connection authenticated with that pairing.
• A closed stream cannot reconnect without a currently valid pairing.
• Local/loopback SSE connections remain unaffected.
• Tests cover expiry and explicit unpairing of an established stream.

Priority

Low. This limits passive event visibility from an already-connected, previously authorized device; it does not permit new commands or API access after authorization ends.