feat(configurator): stream native OpenTofu progress to the UI

[lweberru]

Summary

• Replace active platform-output polling with a bounded authenticated NDJSON channel. Keep the existing JSON snapshot API for history and older clients.
• Project native OpenTofu Plan UI messages while the process is still running; never stream raw event metadata or machine output values. Append the normal human-readable saved Plan using the exact saved binary.
• Publish changed, redacted runner snapshots every 500 ms. Notify local API listeners only after the encrypted database commit, with a one-second cross-instance fallback.
• Revalidate sessions, tenant, deployment role and ownership during streaming. Preserve the 2 MiB limit, complete-line and UTF-8 safety, credential/private-key masking, bounded backpressure, timed renewal and disconnect cleanup. Limit concurrent streams per owner.
• Preserve auto-follow, collapse/reopen, seamless renewal without duplicates, historical output, exact-plan approval and all execution restrictions. Update user and contributor documentation.

Verification

• Pinned Node 24.21.0 / npm 11.19.0: npm run check succeeds; 838 unit tests pass, 66 environment-dependent skips.
• Isolated PostgreSQL platform suite: 60/60, including post-commit notification, encrypted output, tenant/owner access and terminal freeze.
• Full desktop/mobile Playwright suite: 310/310; final targeted stream/Plan/Apply rerun: 32/32.
• Actual OpenTofu 1.12.6: native machine-UI projection, full saved-plan text and summary pass; application/governance offline contracts: 16 + 7 + 3 pass.
• Regression explicitly requires first native progress within 1.5 seconds of the planning stage, before process completion; also tests an unacknowledged publication retry and acknowledged-snapshot deduplication.
• Real HTTP and browser tests render output before EOF, stop on access revocation/disconnect, reconnect without duplication and retain explicit Apply gates.

Operational boundary

No customer Plan/Apply, cloud mutation, merge or deployment was performed. This is not live yet. API/UI and Runner must be released together through the existing manual Configurator Release workflow after merge. Assistant facts and execution capabilities are unchanged.