feat: add resumable application change feed

[windischb]

Summary

• add a versioned per-Application synchronization contract with full snapshot and HTTP polling
• add bearer-only SSE resume via cursor or Last-Event-ID, heartbeat, and live authorization rechecks
• keep a short-lived configurable age/count retention union with explicit reset semantics
• expose per-App enablement and retention settings in the admin UI, disabled by default
• move Service Accounts to event sourcing while preserving legacy document-only accounts
• document consumer setup, scope, message handling, and recovery behavior

SignalARRR remains unchanged and can be added later as another transport over the same envelope.

Verification

• Release solution build
• 1,542 unit tests
• 29 targeted change-feed, authorization, settings, and projection tests
• 722 full API integration tests
• frontend type-check and production build
• public and in-app VitePress builds
• git diff --check

The stable Docker Modgud/PostgreSQL environment was not modified; integration tests used their isolated test container.