fix(ui): remove duplicate SSE connection and guard JSON.parse

[bertheto]

Problem

1. Duplicate SSE connection

startSSE() in index.html was opening two simultaneous EventSource connections:

1. A native inline EventSource with its own onmessage handler (residual code)
2. window.AcbSSE.startSSE() which also opens an EventSource

Both connections were active simultaneously, causing every SSE event to be processed twice (double message appends, double thread refreshes, double agent polling).

The inline block was a leftover from before shared-sse.js was extracted as a module. It was never removed.

2. Unguarded JSON.parse

es.onmessage in shared-sse.js called JSON.parse(e.data) without a try/catch. A single malformed SSE frame would throw an unhandled exception, crashing the SSE listener silently.

Changes

src/static/index.html

• Remove the 30-line residual native EventSource block
• Keep only the delegation to window.AcbSSE.startSSE() which is the canonical, more complete implementation (handles hread.unarchived, null-safe ev.payload || {})

src/static/js/shared-sse.js

• Wrap JSON.parse(e.data) in a try/catch
• Log a warning and return early on parse failure — keeps the SSE listener alive

Tests

• Vitest unit tests: 18/18 passed
• Python unit tests (pytest): 54/54 passed