epic(sdk): SDK feature rollout after #190 cleanup

[EricAndrechek]

Tracking issue for the SDK/API feature work originally scoped into #190.

The foundation/cleanup (WebSocket removal, pnpm-workspace consolidation, biome, root Makefile, coverage enforcement) ships in #190. The remaining feature work is split into focused, individually-reviewable PRs — one per sub-issue below — so nothing balloons into another mega-PR. Each feature PR targets main after #190 merges.

Foundation (shipping in #190)

• Kill WebSocket support; SSE-only transport
• Dedicated SDK Makefile target / root Makefile consolidation
• pnpm workspace consolidation (single root lockfile)
• biome lint + format for TS
• Test coverage enforcement (closes chore(coverage): restore SDK statements coverage threshold to ≥50 #176)
• Re-enable the SSE public-events streaming test (closes test(sdk): re-enable or delete the disabled SSE-public-events streaming test #153)

Planned features (one PR each)

• feat(sdk): NDJSON upload support (API + SDK) #195 — NDJSON upload support (API + SDK)
• feat(sdk): bounded parallel uploading with per-message error handling #196 — Bounded parallel uploading with per-message error handling
• feat(sdk): live DLQ streaming #197 — Live DLQ streaming
• feat(sdk): more helpful TypeScript errors #198 — More helpful TypeScript errors
• refactor(sdk)!: restructure query builder + command naming to match new API routes #199 — Restructure query builder + command naming to match new API routes (breaking)
• feat(sdk): expose raw response/debug internals (cache HIT/MISS) #200 — Expose raw response/debug internals (cache HIT/MISS)
• feat(sdk): more exported, specific error types #201 — More exported, specific error types
• feat(sdk): auto-injected dedupe ID for retransmission detection #202 — Auto-injected dedupe ID for retransmission detection
• feat(sdk): migrate SSE auth from ?token=JWT to Fetch EventSource #203 — Migrate SSE auth from ?token=JWT to Fetch EventSource (+ deprecate token path) (closed by feat(sdk)!: stream over fetch so SSE authenticates by header #470; retiring ?token= server-side split out as fix(auth): deprecate and retire the ?token= query parameter #468)
• feat(sdk): let liveQuery consumers distinguish NATS replay from genuinely-live events #98 — Distinguish NATS replay from genuinely-live events (breaking)
• feat(sdk): SSE replay semantics across multiple subscriptions #204 — SSE replay semantics across multiple subscriptions
• feat(sse): add CORS support to streaming api #215 — CORS to SSE Stream API

Later / not yet scoped (backlog — triage before promoting to Ready)

• feat(api,sdk): accept/return data in formats beyond JSON (CSV first) #252 — Receiving data in other formats (e.g. CSV)
• feat(sdk): on-device SQL validation for the admin raw-SQL route (ClickHouse SQL parser in JS) #253 — On-device SQL validation for the admin route (ClickHouse SQL JS lib or similar)
• feat(api,sdk): groundwork for streaming large (non-live) query up/downloads #254 — Groundwork for streaming (non-live) large up/down queries
• feat(sdk): in-browser SSE multiplexing (per-topic + cross-tab leader election) #255 — SSE multiplexing — in-page per-topic + cross-tab (browser leader election)
• feat(sdk): shared client cache across workers/subscriptions/tabs (IndexedDB) #256 — Local caching shared across workers/subscriptions/tabs (IndexedDB?)
• feat(sdk): embedded WASM query engine (DuckDB?) for on-device queries/aggregations #257 — Embedded WASM engine (DuckDB?) for local queries/aggregations on streamed data
• feat(sdk,policy): expose policy-scoped schema at runtime for best-effort on-device validation #258 — Policy-based runtime schema availability for best-effort on-device validation
• feat(sdk): compile-time schema access for strong types (codegen) #259 — Compile-time optional schema access for strong types (security TBD)