SSE connections now respect middleware headers like CORS

[dcrockwell]

Summary

• SSE connections were silently dropping headers added by middleware (CORS, security headers, etc.), causing cross-origin EventSource requests to fail
• The fix defers the Mist SSE upgrade until after the middleware chain completes, so all middleware-applied headers are included in the SSE response
• Adds 4 new integration test scenarios and middleware examples to the SSE example app

Why

When a controller calls upgrade_to_sse, it was immediately calling Mist's server_sent_events, which sends the HTTP response headers to the TCP socket right away. This happened inside the controller — before middleware had a chance to run on the response. So any middleware that added headers (CORS Access-Control-Allow-Origin, security headers like X-Frame-Options, etc.) would modify the Dream response, but those headers were already on the wire without them. The result: cross-origin SSE requests fail silently with CORS errors.

What

Core fix (3 source files):

• internal.gleam — new upgrade_key constant for a deferred upgrade stash
• sse.gleam — upgrade_to_sse now stashes an upgrade thunk instead of calling Mist directly; the thunk accepts a list of headers and performs the upgrade with them
• handler.gleam — after execute_route returns the middleware-modified response, checks for a stashed upgrade thunk; if found and status is 200, extracts headers from the response and calls the thunk

Safety guard: If middleware returns a non-200 status (e.g., 401 from auth), the upgrade thunk is not called and the error response is returned normally.

Integration tests (4 new scenarios):

• CORS middleware headers appear on SSE response
• Multiple stacked middleware headers all appear
• Middleware rejection (401) prevents the SSE upgrade
• CORS middleware does not interfere with event streaming

Docs: Added "Using Middleware with SSE" section to the SSE guide, updated changelog and release notes.

How

The fix uses a deferred upgrade pattern:

1. Controller calls upgrade_to_sse → stashes a closure (the "upgrade thunk") in the process dictionary under upgrade_key, returns a dummy 200 response
2. Middleware runs on the dummy response, adding CORS/security/other headers
3. Handler detects the stashed thunk, extracts headers from the middleware-modified Dream response, and calls the thunk with those headers
4. The thunk builds a Mist initial_response with all the headers and calls mist.server_sent_events

This is architecturally similar to the existing WebSocket stash-and-upgrade pattern, but uses a separate stash key because WebSocket's mist.websocket doesn't accept an initial_response parameter.

Test plan

• 257 core unit tests pass
• 8 SSE integration tests pass (3 existing + 4 new + 1 cucumber runner)
• 9 WebSocket integration tests pass (no regression)
• Pre-commit hooks pass (format, build all modules and examples)