P2: GET /api/stream returns 400 (SSE live path)

[jaywedgeworth22]

Live 2026-08-23 CURSOR review

Unauthenticated GET /api/stream → 400. If this is the documented live feed, clients get a dead connection. Either document required query params / Accept header or return 401 with a body. Related board item on SSE replay-all.

[jaywedgeworth22]

PR #2281 keeps the 400 (the route is not broken — it requires ?subscription=). The JSON now includes a hint pointing at Premium SSE ?subscription= plus bearer/?token=.