Function handle_sse_events 

pub async fn handle_sse_events(
    __arg0: State<AppState>,
    headers: HeaderMap,
) -> impl IntoResponse

GET /api/events — SSE event stream.

Pairing credentials (QR payloads, one-shot pair codes) are broadcast-only and delivery-once: they ride the live event_tx fan-out and are never written to the history buffer or the persisted JSONL. A subscriber must be connected before pairing to observe them; a client that connects late, reconnects, or lags past the broadcast ring (the discarded BroadcastStreamRecvError below) deliberately cannot recover the credential — that is the non-persistent boundary, not a bug. Recovery would require buffering the secret, which the credential boundary forbids.