Stream Turn

Subscribe to a turn's live SSE frames (Phase 3 split contract).

Auth is the security boundary: ownership (org-scope + the session's owner) is asserted BEFORE a single frame streams — the turn_id UUID is defense-in-depth, not the boundary. Deliberately does NOT use the request-scoped get_session dependency (that would pin a DB connection for the whole relay); it opens a short-lived session only for the ownership check, then reads the turn's Redis stream holding no DB connection.