[C2S] Add Server-Sent Events (SSE) for real-time collection streaming

[pfefferle]

Implements the SWICG ActivityPub API SSE spec so C2S clients can subscribe to live updates on outbox and inbox collections instead of polling.

Proposed changes:

• Add Event_Stream_Controller with SSE stream endpoint (GET /actors/{id}/{collection}/stream) that requires push OAuth scope
• Add Event_Stream signal class using transients to efficiently notify the SSE polling loop of new items
• Add access_token query parameter fallback in OAuth Server for EventSource clients (which cannot send Authorization headers)
• Add eventStream property to outbox and inbox collection responses
• Add proxyEventStream to actor endpoints (proxy endpoint returns 501 for now — wp_remote_get does not support streaming)

Other information:

• Have you written new tests for your changes, if applicable?

Testing instructions:

• Ensure the plugin is active and wp-env is running
• Check actor JSON includes proxyEventStream in endpoints:

  curl http://localhost:8888/wp-json/activitypub/1.0/actors/1 | jq '.endpoints'
  

• Check outbox collection response includes eventStream property:

  curl http://localhost:8888/wp-json/activitypub/1.0/actors/1/outbox | jq '.eventStream'
  

• Obtain an OAuth token with push scope, then test the SSE stream:

  curl -N "http://localhost:8888/wp-json/activitypub/1.0/actors/1/outbox/stream?access_token=TOKEN"
  

  Should receive text/event-stream headers and keepalive comments every 5 seconds
• Publish a post while SSE connection is open — should receive an Add event with the activity JSON

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message

Add real-time event streaming for connected apps using Server-Sent Events.