feat(realtime): long polling for app-wide events behind proxies

When a proxy lets neither WebSocket nor SSE through, the app opens a
poll connection: the server buffers its events (an SSEClient without a
stream), each GET waits up to 25 s, and room joins work like for SSE.
Tasks and lists now update live there too, and note sync takes its
notifications from it instead of a second long poll. Idle connections
close after two minutes. The profile shows such a connection as limited.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/ws/hub_test.go

@@ -1,6 +1,7 @@
 package ws
 
 import (
+	"context"
 	"sync"
 	"testing"
 	"time"
@@ -90,3 +91,29 @@ func TestRoomJoinsRequireAuthorization(t *testing.T) {
 		t.Fatal("joining with another user's sseId must fail")
 	}
 }
+
+// Poll connections nobody asks for any more (tab closed) are closed and stop receiving events.
+func TestIdlePollConnectionsAreClosed(t *testing.T) {
+	hub := NewHub()
+	id := hub.OpenPoll("user-1", nil)
+	hub.BroadcastToUser("user-1", "TEST_EVENT", nil)
+	if events, ok := hub.Poll(context.Background(), id, "user-1", 0); !ok || len(events) != 1 {
+		t.Fatalf("fresh poll connection: ok=%v events=%d", ok, len(events))
+	}
+	if _, ok := hub.Poll(context.Background(), id, "user-2", 0); ok {
+		t.Fatal("another user must not read the connection")
+	}
+
+	hub.mu.Lock()
+	hub.polls[id].lastPoll = time.Now().Add(-PollIdleTimeout - time.Second)
+	hub.mu.Unlock()
+	hub.OpenPoll("user-1", nil) // any poll activity sweeps
+	if _, ok := hub.Poll(context.Background(), id, "user-1", 0); ok {
+		t.Fatal("idle poll connection should be gone")
+	}
+	hub.mu.RLock()
+	defer hub.mu.RUnlock()
+	if len(hub.sseUserRooms["user-1"]) != 1 {
+		t.Fatalf("only the new connection should stay registered, got %d", len(hub.sseUserRooms["user-1"]))
+	}
+}