docs(api): audit streaming/SSE support for chat-interface response streaming

[nghetienhiep]

Closes #6303.

What

A research/audit deliverable — a written inventory of the API layer's streaming/SSE infrastructure, groundwork for the chat-interface spec (#6230, alongside the UI-primitives inventory #6244). New file: src/api/streaming-sse-audit.md. Audit and documentation only — no code changed (per the issue boundary).

Placed beside the audited source, following the merged precedent of src/selfhost/docs-drift-audit-sweep-rfc.md (#5794) — a design/research doc living under src/** next to the code it concerns.

Method

Audited src/api/routes.ts and swept src/**, packages/*/src/**, and apps/*/src/** for every response-streaming primitive (ReadableStream/TransformStream response bodies, text/event-stream/SSE, EventSource, WebSocketPair, Durable Objects, Hono's streamSSE/streamText), plus the Workers deploy config (wrangler.jsonc) and the self-host Node runtime (src/server.ts, src/selfhost/**). Every finding carries a file:line reference.

Findings in brief

• No existing outgoing-streaming / SSE response infra to reuse. Every handler returns a whole response via c.json(...); no route returns a streamed body, sets text/event-stream, or opens a WebSocket. Hono's streaming helpers are available (hono ^4.12.27) but imported nowhere.
• The one stream in the API is incoming — readRequestBodyWithLimit (src/api/routes.ts:399-421) buffers a request body; not reusable for server-sent output.
• Durable Objects are provisioned but rate-limit-only — RateLimiter (src/auth/rate-limit.ts:27), bound as RATE_LIMITER in wrangler.jsonc:272-285. Proves the DO capability the sibling repo's resources/subscribe SSE pattern needs is deployable here, but it does no streaming; wrangler.jsonc:268-271 documents the add-a-DO procedure (SubmissionLock TODO).
• The AI provider layer buffers — src/selfhost/ai.ts calls providers with await res.json() (:333,346,387,394), no stream: true, so even the token source is non-streaming today.
• text/event-stream appears only as a validator of other repos' claims (src/review/content-lane/registry-logic.ts:643-645), and ReadableStream elsewhere is R2/S3 storage I/O (src/selfhost/blob-store.ts:32), not HTTP.
• Workers constraint / self-host caveat: the same Hono app also self-hosts on Node via @hono/node-server (src/server.ts:13,866) where cloudflare:workers is stubbed and the DO is never instantiated (src/selfhost/cf-workers-shim.ts:1-6) — so a DO-coordinated streaming design would not run self-hosted. The doc recommends a plain streamed Response (identical on Workers and Node) with any DO-based multiplexing as a Workers-only enhancement plus a self-host fallback.

Notes

Docs-only, non-binding. No API/schema, wrangler-binding, env-read, or DB change, so no generated artifacts (ui:openapi, cf-typegen, selfhost:env-reference, migrations) are affected. The new markdown adds no coverable source lines.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[JSONbored]

No longer want .md files in the repo, closing.