fix(clients): resolve the SSE token per connect via tokenProvider

[jfrench9]

Summary

Progress streams stopped authenticating after the first session refresh. SSEClient captured token once at construction, but the stream endpoint authenticates the JWT it finds in the URL and the backend revokes the previous JWT on every refresh — so in a tab open longer than ~25 minutes the operator POST still succeeded (the REST interceptor injects a fresh token per call), the run executed and billed, and the client rejected with SSE connection failed before open while nobody was attached. Confirmed in prod logs (auth_token_invalid on /v1/operations/{id}/stream seconds after a successful enqueue, minutes after a session_refresh revocation).

The credential is now resolved on every connect through the same tokenProvider the GraphQL facades already use, and OperatorClient follows a queued run over /status when it cannot open the stream at all, so an already-executing run is never lost.

Changes

Hand-written facade only; generated sdk/ untouched.

• clients/SSEClient.ts — SSEConfig.tokenProvider; connect() resolves the credential per attempt (tokenProvider first, static token otherwise), so automatic reconnects pick up a rotation too. A throwing provider fails the connect with a descriptive error, matching the GraphQL client; a null result connects without a token.
• clients/OperatorClient.ts — OperatorClientConfig (exported) gains tokenProvider. When sseClient.connect() rejects, waitForOperatorCompletion falls back to polling GET /v1/operations/{id}/status (REST auth path) until completed / failed / cancelled; a definitive 4xx ends the wait immediately, transient failures are retried up to three consecutive times, and onProgress receives the status messages. OperatorOptions.pollIntervalMs tunes the interval (default 2000 ms). The sync-200, stream, and polling paths now share one result mapper, which also passes error_details through (OperatorResult.error_details) — the console already reads it. close() now actually closes the active stream (the field it checked was never assigned before).
• clients/OperationClient.ts, clients/QueryClient.ts — config types accept tokenProvider; it flows into the SSEClient they construct.
• clients/index.ts — RoboSystemsClients threads tokenProvider into query, operator, operations, and createSSEClient(), not only the GraphQL facades. robosystems-core already registers a provider via setSDKClientConfig, so consumers pick this up with the version bump alone.
• clients/hooks.ts — useQuery, useStreamingQuery, useOperation, useMultipleOperations, useSDKClients pass getSDKClientConfig().tokenProvider to the clients they build.
• clients/README.md — documents that the SSE-backed clients take tokenProvider and why a static token is not enough in the browser.
• Tests — SSEClient provider resolution/rotation/null/throw; OperatorClient stream completion, provider-at-connect, polling fallback (running → completed), failed run, definitive 404, transient retry, give-up, error_details passthrough; RoboSystemsClients threading; useSDKClients propagation.
• vitest.config.ts — resolves .ts before .js. tsc emits CommonJS .js next to every source (gitignored, present after any local build) and Vite's default order picked the compiled file, where vi.mock cannot intercept require() — the hooks suite had been running against the last build with its config mock inert (its mock exported a name the hooks never import, and nothing noticed). Local runs now match a fresh CI checkout.

Compatibility

ADDITIVE

• New optional config: tokenProvider on SSEConfig, OperatorClientConfig (new export), and the OperationClient / QueryClient constructor configs; OperatorOptions.pollIntervalMs; OperatorResult.error_details.
• Existing calls are unchanged in signature and return type. Two runtime behaviors differ, both on paths that previously failed: a queued operator run whose stream cannot open now resolves via /status instead of rejecting, and OperatorClient.close() now closes an active stream. SSEClient.connect() was already async; it now awaits the credential before constructing the EventSource.

Ships as a minor under the contract (additive stable-tier surface). Version bump is the release dispatch's job, not this PR's.

Testing

• npm run test:all equivalent via the pre-commit hook: prettier, lint, typecheck clean; 313 tests passed across 10 files (15 added). npm run build succeeded.
• Note the vitest resolution change is what makes the new hooks assertion — and every vi.mock-based test — meaningful after a local build; before it, the suite passed against stale compiled output.
• Not exercised end-to-end against a live session in this branch; the failing prod sequence it fixes is documented above from the API logs.