feat(realtime): replace device polling with SSE push for all shared data

ARCHITECTURE.md

@@ -382,6 +382,12 @@ All `/api/*` routes return JSON. Every route except the public auth/config endpo
 |   +-- PUT    /{id}                    # Update status; cancel>teardown trigger     [auth]
 |   +-- DELETE /{id}                    # Delete booking                            [auth]
 |
++-- /events
+|   +-- GET    /                       # SSE stream; token via ?token= query param  [auth]
+|   |                                  # Sends full snapshot on connect, then pushes
+|   |                                  # bookings/devices/labs/logs/links/users-update
+|   |                                  # events after every mutation or background job
+|
 +-- /logs
 |   +-- GET    /                       # All logs, newest first                     [auth]
 |   +-- POST   /                       # Manual log entry                           [auth]
@@ -462,6 +468,7 @@ Step 2  for each device:
         - on change: write a 'status' log
 Summary log per cycle: "<online> online, <offline> offline, <unknown> unknown"
 HTTP hints: 401/403/404 mapped to actionable messages (checkmkHttpHint)
+After each cycle: broadcastDevices() + broadcastLogs() > SSE push to all clients
 ```
 
 ### 6.2 Ansible Semaphore — Playbook Automation
@@ -482,6 +489,7 @@ triggerSemaphoreTask(templateId, extraVars):
   extraVars = { booking_id, lab_name, user_id, start_time, end_time }
   > store returned job id on booking; log success/failure
   (a booking with no template id is marked triggered > not retried)
+After each cycle: broadcastBookings() + broadcastLogs() > SSE push to all clients
 
 Manual:  POST /api/semaphore/trigger/{bookingId}  body { type: 'setup'|'teardown' }
          GET  /api/semaphore/templates  (proxy for UI dropdowns)
@@ -584,12 +592,14 @@ src/
 |                selectedBookingForDetails, inventoryHighlightDevice, checkmk{Enabled,BaseUrl}
 +-- Effects:
 |   +-- Startup token verify + OAuth ?token=/?auth_error= handling
-|   +-- Load data on login
-|   +-- Poll GET /api/devices every 30s   (surface CheckMK-driven status changes)
+|   +-- Load data on login (one Promise.all; initial seed before SSE connects)
+|   +-- SSE connection to GET /api/events — receives full snapshot on (re)connect,
+|   |   then live pushes for bookings/devices/labs/logs/links/users on any mutation
+|   |   or background job; auth-error event triggers logout on token expiry
 |   +-- Booking reminder check every 60s  (fires once per upcoming booking ≤30min away)
 +-- Handlers:    handleAdd/Update/Delete* for bookings, devices, labs, links, users +
-                 handleAddLogManually — call API via authFetch, update local state,
-                 most then refetch /api/logs
+                 handleAddLogManually — call API via authFetch, update local state
+                 (SSE pushes the authoritative state to all tabs within ~1s)
 
 (* persisted to localStorage)
 ```