SSE client: no 401 handling, fixed 3s reconnect with no backoff, unsubscribe can't cancel an in-flight fetch

[manjula25]

Summary

The SSE client (connectOnce) has no 401 handling, reconnects on a fixed 3-second loop with no backoff, and its unsubscribe cannot cancel an in-flight reader.read().

Evidence

apps/web/src/api/client.ts:509-556:

if (!res.ok || !res.body) return;   // 401/500 just falls through to the 3s reconnect loop

Impact

• A 401 never emits AUTH_LOGOUT_EVENT (unlike apiFetch), so an expired session keeps reconnecting forever instead of logging out.
• During a 5xx outage, every mounted subscriber (PatientDetail, TaskDetail, and AppShell each open their own connection) polls the server every 3 seconds.
• Unsubscribe leaves the fetch open until the server sends its next frame.