feat(#195): SSE realtime Cartes (stream + emit audience)

GET /api/v1/cards/stream (Bearer ou ?access_token=).
Events card.created|updated|deleted, response.added + heartbeat.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/modules/cards/cards-realtime.service.spec.ts

@@ -0,0 +1,47 @@
+import { MessageEvent } from '@nestjs/common';
+import { CardsRealtimeService } from './cards-realtime.service';
+
+describe('CardsRealtimeService (#195)', () => {
+  let service: CardsRealtimeService;
+
+  beforeEach(() => {
+    service = new CardsRealtimeService();
+  });
+
+  afterEach(() => {
+    service.onModuleDestroy();
+  });
+
+  it('émet card.created aux abonnés du user', async () => {
+    const events: MessageEvent[] = [];
+    const sub = service.streamFor('user-a').subscribe((e) => events.push(e));
+
+    await new Promise((r) => setTimeout(r, 20));
+    expect(events[0]?.type).toBe('heartbeat');
+    expect(service.subscriberCount('user-a')).toBe(1);
+
+    service.emitToUsers(['user-a', 'user-b'], 'card.created', 'card-1', {
+      id: 'card-1',
+    });
+    await new Promise((r) => setTimeout(r, 20));
+
+    const created = events.find((e) => e.type === 'card.created');
+    expect(created).toBeDefined();
+    expect((created!.data as { card_id: string }).card_id).toBe('card-1');
+    expect(service.subscriberCount('user-b')).toBe(0);
+
+    sub.unsubscribe();
+    expect(service.subscriberCount('user-a')).toBe(0);
+  });
+
+  it('ne diffuse pas aux users non abonnés', async () => {
+    const events: MessageEvent[] = [];
+    const sub = service.streamFor('user-a').subscribe((e) => events.push(e));
+    await new Promise((r) => setTimeout(r, 20));
+    const before = events.length;
+    service.emitToUsers(['user-b'], 'card.updated', 'x');
+    await new Promise((r) => setTimeout(r, 20));
+    expect(events.length).toBe(before);
+    sub.unsubscribe();
+  });
+});