refactor(sse-crates): vendor reqwest-eventsource and eventsource-stream as forge_eventsource and forge_eventsource_stream

[laststylebender14]

Summary

Vendor the reqwest-eventsource and eventsource-stream crates as first-party workspace crates (forge_eventsource and forge_eventsource_stream), giving the project full control over their source code and eliminating external dependency pins.

Context

The project relied on two crates (reqwest-eventsource v0.6.0 and eventsource-stream v0.2.3) from crates.io for Server-Sent Events (SSE) support. Vendoring them as local workspace crates allows us to fix lint violations, apply project-specific improvements, and remove transitive dependency churn without waiting for upstream releases.

Changes

• crates/forge_eventsource_stream — new crate vendored from eventsource-stream. Provides a Stream-based SSE parser that works over any Stream<Item = Result<Bytes, _>>. Includes EventStream, Event, EventStreamError, and the Eventsource extension trait.
• crates/forge_eventsource — new crate vendored from reqwest-eventsource. Wraps forge_eventsource_stream with reqwest-specific glue: automatic reconnection, retry policy, Last-Event-ID tracking, RequestBuilderExt, and an EventSource Stream implementation.
• Workspace deps — removed reqwest-eventsource and eventsource-stream from [workspace.dependencies]; added forge_eventsource and forge_eventsource_stream pointing to the new crate paths.
• Consumer crates — updated forge_app, forge_infra, forge_repo, and forge_services Cargo.toml and source imports to reference the new workspace crates.

Key Implementation Details

• BOM stripping in event_stream.rs now uses str::strip_prefix(is_bom) (passing the predicate function directly) instead of the unsafe index &string[1..], eliminating both clippy::string_slice and clippy::indexing_slicing violations while correctly handling the 3-byte UTF-8 encoding of U+FEFF.
• Error::InvalidStatusCode and Error::InvalidContentType in forge_eventsource now carry Box<Response> instead of bare Response, resolving clippy::result_large_err without changing the public API semantics.
• Call sites in forge_repo that previously passed the response directly now dereference via *response.
• The mock update_environment impl in forge_services::mcp::service tests was converted from the fn … -> impl Future form to idiomatic async fn, fixing clippy::manual_async_fn.
• Doc comments in EventBuilder::dispatch had continuation lines that lacked the required indentation, causing clippy::doc_lazy_continuation; these are now correctly indented.

Testing

# Verify compilation and lint cleanliness
cargo check --workspace
cargo +nightly clippy --all-features --workspace --all-targets --fix --allow-dirty -- -D warnings
cargo +nightly clippy --all-features --workspace -- -D clippy::string_slice -D clippy::indexing_slicing -D clippy::disallowed_methods

# Run tests for directly affected crates
cargo nextest run -p forge_eventsource -p forge_eventsource_stream -p forge_repo