feat: realtime WebSocket layer for live events and streaming logs

- Backend: ConnectionManager, Redis-backed bus with in-process fallback,
  channel authorization, and typed emit helpers wired into workers
  (ai_runtime, sandbox_gateway), workforce/sandbox/billing/audit/error services.
- Frontend: single shared WS client with backoff + heartbeat, RealtimeProvider,
  useLiveChannel/useLiveEvent hooks, live indicators on task detail, manager
  chat, dashboard, traces, sandbox terminal, admin errors, and billing.
- Contracts: WsEvent/WsServerFrame/WsClientFrame types mirroring the port.

All 255 backend tests pass; web typecheck and build pass.

apps/api/tests/conftest.py

@@ -39,6 +39,18 @@ def _production_shaped_jwt_secret():
     settings.jwt_secret = "test-only-jwt-secret-with-more-than-32-bytes"
 
 
+@pytest.fixture(scope="session", autouse=True)
+def _hermetic_realtime_transport():
+    """Pin the realtime bus to in-process delivery.
+
+    ``auto`` would make every publish attempt a Redis connection to
+    ``localhost:6379`` — the suite has no broker, so each event would add a
+    connection timeout and log noise. The fan-out behaviour under test does not
+    depend on the transport.
+    """
+    settings.realtime_transport = "local"
+
+
 @pytest_asyncio.fixture
 async def engine():
     # StaticPool keeps one connection alive so the in-memory schema survives