Serve live queries to anonymous callers over the SSE hub

[woksin]

Fixed

• Live queries work for anonymous callers over the SSE hub, the transport the @cratis/arc.react <Arc> provider uses by default, as they do with Arc on .NET. Previously the SSE hub accepted only authenticated callers, so observable queries in anonymous applications stayed empty unless the client switched to WebSockets.

Security

• SSE hub control requests are accepted only from the caller that opened the connection: the same identity for authenticated callers, and additionally the same peer address for anonymous callers when the host provides one. Control requests must be JSON and pass the allowed-origins check, and each subscription still runs the query's own authorization.