feat: phase 3 observability — IMS telemetry merge

Port IMS telemetry into Primora conventions:

- core.components/core.events (migration 00004 + sqlc) scoped to projects
- POST /api/v1/ingest — single or <=500-event batches via project prm_
  keys (X-Primora-Key alias), auto-registering components, permissive CORS
- Issues: fingerprint-grouped errors with count/severity/first+last seen
- Reads: events w/ filters + before-cursor, components, stats (1h/24h/7d/30d
  bucketed series + component health + totals + metric names), metric
  series (avg/p50/p95/max)
- GET .../telemetry/stream — project-scoped SSE through an in-process hub
  (buffered subs, drop-on-slow, 25s keepalives); ?api_key=/?token= auth
  for EventSource
- Telemetry page: health/issues/events/metrics/integrate tabs, live badge,
  390px-clean; demo stubs
- @primora/client SDK (createPrimoraClient: capture*/heartbeat/installAuto,
  queued keepalive flushes)
- MCP: primora_list_issues/list_events/telemetry_stats/metric_series
- IMS README deprecation note pointing here

Also fixes workspace pins to 0.3.0 — npm ci in the frontend image was
resolving the unpublished 0.2.0 spec from the registry.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/internal/middleware/context.go

@@ -74,7 +74,20 @@ func Logger(logger *slog.Logger) gin.HandlerFunc {
 func (m AuthMiddleware) ResolveActor() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		apiKey := strings.TrimSpace(c.GetHeader("X-API-Key"))
+		if apiKey == "" {
+			apiKey = strings.TrimSpace(c.GetHeader("X-Primora-Key"))
+		}
 		authz := strings.TrimSpace(c.GetHeader("Authorization"))
+		// EventSource cannot set headers — the SSE stream accepts credentials
+		// as query params instead.
+		if apiKey == "" && authz == "" && strings.HasSuffix(c.Request.URL.Path, "/telemetry/stream") {
+			apiKey = strings.TrimSpace(c.Query("api_key"))
+			if apiKey == "" {
+				if t := strings.TrimSpace(c.Query("token")); t != "" {
+					authz = "Bearer " + t
+				}
+			}
+		}
 		if apiKey == "" && strings.HasPrefix(strings.ToLower(authz), "bearer ") {
 			token := strings.TrimSpace(strings.TrimPrefix(authz, "Bearer"))
 			if strings.HasPrefix(authz, "Bearer ") {