Fixes #6029. Stacked on #6031 (fix/6022-6024-6026-security).

Problem

SSE streaming endpoints (streamClusters in pkg/api/handlers/sse.go) run inside SetBodyStreamWriter callbacks that block until either the client disconnects or sseOverallDeadline (~30s) fires. When a user logged out, any in-flight SSE streams kept emitting cluster_data events until that deadline — the token was revoked but the already-established stream had no active cancellation path.

Fix

Mirrors the exec-session cancellation pattern added in #6031 for /ws/exec sessions (#6024).

• New per-user SSE session registry in sse.go:
  • sseSessions map[uuid.UUID]map[int64]context.CancelFunc guarded by a plain sync.Mutex
  • registerSSESession / unregisterSSESession / CancelUserSSEStreams
  • Monotonic session-id generator so multiple concurrent streams for the same user are tracked independently
• streamClusters captures the authenticated user ID before entering the deferred SetBodyStreamWriter callback (the fiber.Ctx may be reused by then, so c.Locals is not safe to read inside), then registers the stream context's cancel func in the registry with a deferred unregister for normal stream end. All 17 SSE handlers in sse.go route through streamClusters, so one registration site covers every streaming endpoint.
• auth.Logout calls CancelUserSSEStreams(claims.UserID) immediately after the existing CancelUserExecSessions call, tearing down any live SSE streams for the user on logout.
• streamDemoSSE is intentionally left unchanged — demo streams are instant (no blocking, no goroutines), so they need no cancellation path.

Tests

New pkg/api/handlers/sse_test.go mirroring exec_test.go:

• TestCancelUserSSEStreams_CancelsRegisteredContexts — register two contexts, call cancel, verify both Done() and the per-user map entry is cleared
• TestCancelUserSSEStreams_OtherUserUnaffected — register two users, cancel one, verify the other's context is still alive
• TestUnregisterSSESession_RemovesEntry — verify per-session removal drops only the target entry and the per-user slot is removed when empty
• TestCancelUserSSEStreams_NoSessions — must not panic on empty map

All pass:

=== RUN   TestCancelUserSSEStreams_CancelsRegisteredContexts
--- PASS
=== RUN   TestCancelUserSSEStreams_OtherUserUnaffected
--- PASS
=== RUN   TestUnregisterSSESession_RemovesEntry
--- PASS
=== RUN   TestCancelUserSSEStreams_NoSessions
--- PASS

Verification

• go build ./... — clean
• go test ./pkg/api/handlers/... -count=1 — passes
• go vet ./... — clean
• cd web && npm run build — clean (post-build safety checks pass)

Code quality

• sync.Mutex (not RWMutex) — matches the exec-session pattern
• uuid.UUID for user ID throughout — matches the rest of the codebase
• New constants have comments; no magic numbers introduced
• Unrelated SSE code untouched