feat: AI dev stream over HTTPS (SSE read + draft writeback)

Replaces the Redis-over-Tailscale handoff with a far simpler HTTP surface
on the existing public API — no Redis client, Tailscale, or firewall changes
needed on the dev side.

- GET /ai/stream — SSE feed of every ingested message, reads the internal
  Redis stream; resumes from Last-Event-ID on reconnect (no missed messages);
  heartbeats keep the connection warm through proxies
- POST /ai/drafts — writeback: creates a ContentDraft (PENDING_REVIEW) that
  shows up in the admin /admin/drafts review UI
- AiStreamGuard — static bearer token auth (AI_STREAM_TOKEN), accepts header
  or ?token= query for browser EventSource
- Remove Tailscale sidecar + public Redis port; Redis stays internal-only

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/config/src/index.ts

@@ -15,6 +15,7 @@ const envSchema = z.object({
   JWT_EXPIRES_IN: z.string().default('7d'),
   MEMBER_JWT_EXPIRES_IN: z.string().default('30d'),
   OPENROUTER_API_KEY: z.string().optional(),
+  AI_STREAM_TOKEN: z.string().optional(),
 });
 
 export type Env = z.infer<typeof envSchema>;