v0.4.2 — CLI live progress (real-time phase + message)

Two bugs in the post-scan progress display, surfaced during the launch smoke test.

Fixed

• cli.client.stream_events now JSON-decodes the SSE data field instead of passing a raw string back. Each yielded event is {"event": "...", "data": dict}.
• _stream_progress reads data["phase"] and data["message"] and renders phase · message — previously it tried to split a JSON string on a " · " separator that never existed, so the spinner stuck on queued · {raw JSON} for the entire run.
• iter_lines(chunk_size=1) for line-at-a-time flushing — without this, SSE events buffer up to ~512 bytes and the spinner sits on a stale phase while the next event waits in the socket buffer.

End result: the CLI now updates in real time as scans progress through cloning → scanning → correlating → reporting, with the latest per-phase log line.