Expose authenticated REST and SSE remote API (#47)

[4nass]

Delivered

• Adds a transport-neutral WSGI REST/SSE application for the remote MVP loop.
• POST /v1/jobs resolves only allowlisted project IDs, enforces signed principal/scopes and durable idempotency, then starts the detached worker.
• GET status/events, cooperative cancel, approval, and compact artifact references are authenticated and principal-isolated.
• SSE supports durable event cursors and Last-Event-ID reconnects without duplicate/lost events.
• Adds strict request-size/JSON validation, generic safe errors, 401/403 separation, and no path/prompt disclosure.
• Adds development server wiring with credentials sourced from an environment secret, plus deployment documentation.
• Carries the authenticated transport commits from Provide an authenticated transport and verified remote principals #44 and the structured event/cancellation implementation from Emit structured progress events and support cooperative cancellation #29 as required dependencies.

Validation

• 810 tests passed; 2 pre-existing pytest collection warnings.
• API contract tests cover duplicate submission, authorization isolation, SSE replay, cancellation, approval, malformed input and authentication.

Deployment boundary

The WSGI app must be behind TLS, a secret manager, rate limiting and a process supervisor. WebSocket and preview deployment remain out of scope.

Closes #47

[4nass]

Status

Delivered: authenticated REST/SSE WSGI API, allowlisted projects, signed principals, idempotency, status/events/cancel/approval/artifacts, SSE replay, safe errors and request validation.

Residual: production TLS proxy, rate limiting and secret manager are deployment requirements. WebSocket and preview deployment remain out of scope.

Closes #47 is present in the PR description.

[4nass]

Superseded by #67 (commit 363c051 on main), which carries this work as rebased copies together with the later fixes. Verified in origin/main: the replay-window fix and cross-process nonce test, the cooperative-cancellation rework, the signed query string, pre-parse authentication, access logging and the threaded SSE server are all present. Closing rather than merging: this branch's copies are older than what shipped.