Add realtime invalidation for web views

[mjc]

Summary

Adds a small realtime invalidation path for the web UI: writes broadcast that affected issue/project data changed, and mounted views refetch through their existing HTTP loaders. The socket does not stream canonical object state or try to merge data client-side.

This keeps the change scoped to the delay called out in #3 while covering both write paths that can change what the UI is showing: REST handlers and MCP tools.

What Changed

• Adds an authenticated /api/events/ws endpoint backed by the existing browser session cookie.
• Applies websocket-safe origin handling: non-browser clients without Origin, same-origin browser requests, or explicitly configured origins are accepted.
• Broadcasts issue/project invalidation events from REST writes, including relation link/unlink with the correct project for each affected issue.
• Broadcasts matching invalidation events from MCP writes, including authless MCP.
• Keeps the realtime event enum limited to events this PR actually emits.
• Replaces broad refresh-on-everything behavior with relevant-event refresh checks, coalescing, and logged refresh failures.
• Removes the old 15-second polling from the views now covered by focus revalidation plus websocket invalidation.

Deliberate Scope

This is invalidation-only realtime. HTTP remains the source of truth for view data.

[Copilot]

Pull request overview

This PR introduces a websocket-based “realtime invalidation” channel so mounted web UI views can refetch via their existing HTTP loaders when issue/project data changes, and removes/relaxes prior 15s polling in several views.

Changes:

• Backend: adds a RealtimeHub + /api/events/ws websocket endpoint (cookie-session auth + origin policy) and emits invalidation events from REST + MCP write paths.
• Frontend: establishes a single reconnecting websocket in App.svelte and dispatches events into the existing startAutoRefresh helper.
• Frontend: replaces refresh-on-everything polling with event-filtered refresh logic in some views, and removes polling in others.

Reviewed changes

Copilot reviewed 19 out of 20 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
web/src/routes/ProjectActivity.svelte	Switches auto-refresh to event-filtered invalidation instead of fixed polling.
web/src/routes/PlanList.svelte	Removes polling from plan list auto-refresh.
web/src/routes/PlanDetail.svelte	Removes polling from plan detail auto-refresh.
web/src/routes/PageList.svelte	Removes polling from page list auto-refresh.
web/src/routes/IssueList.svelte	Switches issues list auto-refresh to event-filtered invalidation instead of fixed polling.
web/src/routes/IssueDetail.svelte	Adds busy-guarded invalidation refresh and binds editor mode to prevent disruptive reloads.
web/src/lib/autoRefresh.svelte.ts	Adds realtime event integration, coalescing/pending refresh behavior, and refresh failure logging.
web/src/App.svelte	Adds websocket connect/reconnect logic and dispatches invalidation events into the app.
src/realtime.rs	Introduces the realtime hub, event enum, and websocket servicing loop.
src/mcp/tools.rs	Emits realtime invalidation events from MCP write operations (issues/projects/relations/comments).
src/mcp/mod.rs	Wires a shared RealtimeHub into MCP so writes can emit invalidation events.
src/main.rs	Registers the realtime module, shares the hub across REST + MCP routers, and adjusts CORS/auth skip logic.
src/authz_coverage_tests.rs	Updates REST manifest coverage to account for the websocket endpoint.
src/api/projects.rs	Emits project invalidation events for create/update/delete/reorder.
src/api/mod.rs	Adds /api/events/ws route and websocket auth/origin validation helpers.
src/api/issues.rs	Emits issue invalidation events for create/update/delete/link/unlink + adds a realtime emission test.
src/api/comments.rs	Emits issue invalidation events on issue-comment create/update/delete.
src/api/attachments.rs	Updates tests/apps to include the realtime hub extension.
Cargo.toml	Enables Axum websocket support.
Cargo.lock	Locks new websocket-related transitive dependencies.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.