SSE live tail with full SPL2 pipeline

Server-Sent Events stream for real-time log tailing with full SPL2 pipeline support. Uses the same query engine as POST /query, but in streaming mode.

Two phases:

1. Catchup — replays the last count matching events from storage (time range: from to now). Each event is sent as event: result. Phase ends with event: catchup_done.
2. Live — streams new events from the EventBus through the SPL2 pipeline in real time. Events are sent as event: result. Heartbeat every 15s as event: heartbeat.

Supported SPL2 commands (streaming, event-by-event): search, where, eval, fields, table, rename, rex, fillnull, head, bin.

Commands requiring full materialization (stats, sort, join, dedup, timechart, etc.) are rejected with 422.

const es = new EventSource("/api/v1/tail?q=search+ERROR+|+where+status>500&count=100&from=-1h");
es.addEventListener("result",       (e) => appendRow(JSON.parse(e.data)));
es.addEventListener("catchup_done", (e) => showLiveIndicator());
es.addEventListener("heartbeat",    (e) => updatePing());
es.addEventListener("error",        (e) => showError(JSON.parse(e.data)));

SSE (not WebSocket) because this is a unidirectional server-to-client stream. SSE auto-reconnects, passes through proxies, and works with the native EventSource browser API.