feat(sse): per-connection filtering with user and workstation context

- Extend sseClient with userID, workstationID, and item filter set
- Update Subscribe() to accept userID and workstationID params
- Add WatchItem/UnwatchItem/IsWatchingItem methods on sseClient
- Add PublishToItem, PublishToWorkstation, PublishToUser targeted delivery
- Targeted events get IDs but skip history ring buffer (real-time only)
- Update HandleEvents to pass auth user ID and workstation_id query param
- Touch workstation last_seen on SSE connect
- Existing Publish() broadcast unchanged; all current callers unaffected
- Add 5 new tests for targeted delivery and item watch lifecycle

Closes #162

internal/api/servermode_test.go

@@ -76,7 +76,7 @@ func TestServerStateToggleReadOnly(t *testing.T) {
 
 func TestServerStateBroadcastsOnTransition(t *testing.T) {
 	b := NewBroker(zerolog.Nop())
-	c := b.Subscribe()
+	c := b.Subscribe("", "")
 	defer b.Unsubscribe(c)
 
 	ss := NewServerState(zerolog.Nop(), nil, b)