feat: phase 7 automation & realtime — scheduled jobs, domain events, SSE

Scheduled jobs (migration 00009): cron expressions + @every descriptors,
in-process scheduler (15s scan, missed-run collapse), signed HTTP POST
delivery (X-Primora-Signature), AES-256-GCM sealed secrets returned once,
run history with status/duration/http-code, manual execution, retention
pruning. Viewer reads, admin/developer writes.

Domain events: publishEvent fans document/object/issue/deploy/job
mutations to realtime subscribers and matching webhooks through one
path. Webhook event filter extended to job.run, document.*, object.*.

Realtime: GET /projects/:id/realtime/stream SSE with 25s keepalives and
?token=/?api_key= auth for EventSource clients.

Automation dashboard page: Schedules tab (CRUD, run history, manual run,
secret-once banner) + Live events tab (live badge, pause/clear). Demo
mode parity. primora jobs:* CLI group, six primora_*_job* MCP tools,
AutomationService in the generated client.

Fixes folded in: gzip middleware buffered SSE flushes (broke EventSource
on both streams — */stream now bypasses compression); event payloads
double-marshaled json.RawMessage as base64; compose hardcoded localhost
trusted origins so non-default ports broke sign-in; frontend auth base
URL baked an absolute localhost instead of resolving /auth on origin.

Verified live: stack up on :8085, signed delivery HMAC-checked at sink,
@every 30s schedule firing, run history rendering, document.created
landing in the live events feed.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/cli/src/cli.ts

@@ -4,6 +4,7 @@ import { cmdLogin, cmdLogout, cmdWhoami } from "./commands/auth.js";
 import { cmdAuditList } from "./commands/audit.js";
 import { cmdBucketsCreate, cmdBucketsList } from "./commands/buckets.js";
 import { cmdContext, cmdUse } from "./commands/context.js";
+import { cmdJobsCreate, cmdJobsList, cmdJobsRemove, cmdJobsRun, cmdJobsRuns } from "./commands/jobs.js";
 import { cmdKeysCreate, cmdKeysList, cmdKeysRevoke } from "./commands/keys.js";
 import {
   cmdObjectsDownload,
@@ -104,6 +105,34 @@ cli
   .option("--yes", "Skip the confirmation prompt")
   .action(cmdKeysRevoke);
 
+cli
+  .command("jobs:list", "List scheduled jobs in the current project")
+  .option("--project <id>", "Project override")
+  .action(cmdJobsList);
+cli
+  .command("jobs:create <name>", "Create a scheduled job (secret shown once if generated)")
+  .option("--project <id>", "Project override")
+  .option("--schedule <cron>", "Cron or descriptor, e.g. '*/15 * * * *' or '@every 1h'")
+  .option("--url <url>", "Target endpoint (HTTPS public, HTTP private)")
+  .option("--payload <json>", "Static JSON payload merged into every delivery")
+  .option("--secret <secret>", "HMAC signing secret (generated if omitted)")
+  .option("--disabled", "Create paused — enable via the dashboard or API")
+  .action(cmdJobsCreate);
+cli
+  .command("jobs:run <job>", "Trigger a manual run now")
+  .option("--project <id>", "Project override")
+  .action(cmdJobsRun);
+cli
+  .command("jobs:runs <job>", "List run history for a job")
+  .option("--project <id>", "Project override")
+  .option("--limit <n>", "Page size (default 50)")
+  .action(cmdJobsRuns);
+cli
+  .command("jobs:rm <job>", "Delete a scheduled job")
+  .option("--project <id>", "Project override")
+  .option("--yes", "Skip the confirmation prompt")
+  .action(cmdJobsRemove);
+
 cli
   .command("audit:list", "List audit events for the current project")
   .option("--project <id>", "Project override")
@@ -121,7 +150,7 @@ cli.version("0.4.0");
 // cac only matches the first positional token, so "orgs list" cannot be a
 // command name. Fold "group verb" pairs into "group:verb" before parsing —
 // `primora orgs list` and `primora orgs:list` both work.
-const GROUPS = new Set(["orgs", "projects", "buckets", "objects", "keys", "audit"]);
+const GROUPS = new Set(["orgs", "projects", "buckets", "objects", "keys", "jobs", "audit"]);
 const argv = process.argv.slice(2);
 if (GROUPS.has(argv[0]) && argv[1] && !argv[1].startsWith("-")) {
   argv.splice(0, 2, `${argv[0]}:${argv[1]}`);