Add streaming capabilities and improve API stability and security

Introduce streaming for AI job execution, implement rate limiting for API endpoints, enhance CORS configuration, and refactor event handling.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 418bf6f8-212b-4bb0-a7a5-8231a061da4e
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: 2967540c-7b01-4168-87be-fde774e32494
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/9f85e954-647c-46a5-90a7-396e495a805a/418bf6f8-212b-4bb0-a7a5-8231a061da4e/Q83Uqvu
Replit-Helium-Checkpoint-Created: true

artifacts/api-server/src/routes/sessions.ts

@@ -3,6 +3,8 @@ import { randomBytes, randomUUID } from "crypto";
 import { db, sessions, sessionRequests, type Session } from "@workspace/db";
 import { eq, and } from "drizzle-orm";
 import { lnbitsService } from "../lib/lnbits.js";
+import { sessionsLimiter } from "../lib/rate-limiter.js";
+import { eventBus } from "../lib/event-bus.js";
 import { agentService } from "../lib/agent.js";
 import { pricingService } from "../lib/pricing.js";
 import { getBtcPriceUsd, usdToSats } from "../lib/btc-oracle.js";
@@ -133,7 +135,7 @@ async function advanceTopup(session: Session): Promise<Session> {
 
 // ── POST /sessions ─────────────────────────────────────────────────────────────
 
-router.post("/sessions", async (req: Request, res: Response) => {
+router.post("/sessions", sessionsLimiter, async (req: Request, res: Response) => {
   const rawAmount = req.body?.amount_sats;
   const amountSats = parseInt(String(rawAmount ?? ""), 10);