feat: realtime WebSocket layer for live events and streaming logs

- Backend: ConnectionManager, Redis-backed bus with in-process fallback,
  channel authorization, and typed emit helpers wired into workers
  (ai_runtime, sandbox_gateway), workforce/sandbox/billing/audit/error services.
- Frontend: single shared WS client with backoff + heartbeat, RealtimeProvider,
  useLiveChannel/useLiveEvent hooks, live indicators on task detail, manager
  chat, dashboard, traces, sandbox terminal, admin errors, and billing.
- Contracts: WsEvent/WsServerFrame/WsClientFrame types mirroring the port.

All 255 backend tests pass; web typecheck and build pass.

apps/api/app/workers/sandbox_gateway.py

@@ -21,6 +21,7 @@ from __future__ import annotations
 from datetime import timedelta
 
 from app.application.container import build_sandbox_service
+from app.application.ports.realtime import emit_sandbox_reaped
 from app.core.config import settings
 from app.domain.audit.models import AuditAction, AuditEvent
 from app.domain.base import utcnow
@@ -72,6 +73,13 @@ class SandboxGatewayWorker:
                 )
                 outcome.processed += 1
                 outcome.note(f"stopped session {sandbox_session.id}")
+                # A reaped sandbox is a tenant-visible fact: push it so the
+                # project page's terminal stops showing a live session.
+                await emit_sandbox_reaped(
+                    organization_id=workspace.organization_id if workspace else None,
+                    session_id=sandbox_session.id,
+                    workspace_id=sandbox_session.workspace_id,
+                )
 
             if not stopped:
                 outcome.skipped += 1