feat(realtime): long polling for app-wide events behind proxies

When a proxy lets neither WebSocket nor SSE through, the app opens a
poll connection: the server buffers its events (an SSEClient without a
stream), each GET waits up to 25 s, and room joins work like for SSE.
Tasks and lists now update live there too, and note sync takes its
notifications from it instead of a second long poll. Idle connections
close after two minutes. The profile shows such a connection as limited.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/realtime.go

@@ -3,7 +3,9 @@ package api
 import (
 	"encoding/json"
 	"net/http"
+	"strconv"
 	"strings"
+	"time"
 
 	"github.com/go-chi/chi/v5"
 	"github.com/sandrodach/mindsift/internal/auth"
@@ -125,3 +127,29 @@ func (s *Server) handleSSERooms(w http.ResponseWriter, r *http.Request) {
 	}
 	writeJSON(w, http.StatusOK, map[string]bool{"success": true})
 }
+
+// handleOpenPoll starts a long-poll connection (third transport after WebSocket and SSE, for proxies that
+// let neither through). Rooms can be given right away or joined later via /events/rooms with the id.
+func (s *Server) handleOpenPoll(w http.ResponseWriter, r *http.Request) {
+	var req struct {
+		Rooms []string `json:"rooms"`
+	}
+	_ = json.NewDecoder(http.MaxBytesReader(w, r.Body, 16384)).Decode(&req)
+	writeJSON(w, http.StatusOK, map[string]string{"pollId": s.wsHub.OpenPoll(auth.GetUserID(r.Context()), req.Rooms)})
+}
+
+// handlePoll returns the events of a poll connection as soon as there are some, at the latest after
+// `wait` seconds (empty list). 404: the connection expired, the client opens a new one.
+func (s *Server) handlePoll(w http.ResponseWriter, r *http.Request) {
+	wait := longPollMax
+	if sec, err := strconv.Atoi(r.URL.Query().Get("wait")); err == nil && sec >= 0 && time.Duration(sec)*time.Second < wait {
+		wait = time.Duration(sec) * time.Second
+	}
+	_ = http.NewResponseController(w).SetWriteDeadline(time.Now().Add(wait + 10*time.Second))
+	events, ok := s.wsHub.Poll(r.Context(), chi.URLParam(r, "id"), auth.GetUserID(r.Context()), wait)
+	if !ok {
+		writeError(w, http.StatusNotFound, "Verbindung abgelaufen")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]interface{}{"events": events})
+}