refactor(auth): require bearer token only, drop legacy token header and cookie

Authenticate requests solely from the Authorization: Bearer header on the
server; stop accepting the legacy `token` header and `usertoken` cookie.
The frontend no longer sets auth cookies (only clears legacy ones), omits
credentials on all requests, and drops the redundant `token` header. Project
event SSE now streams over fetch so it can carry the Authorization header,
which EventSource cannot.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

frontend/src/infrastructure/designGateway.ts

@@ -159,7 +159,8 @@ async function request<T>(path: string, init?: RequestInit): Promise<T> {
   try {
     response = await fetch(path, {
       ...init,
-      headers
+      headers,
+      credentials: "omit"
     });
   } catch (err) {
     throw createNetworkFailure("design", err);
@@ -393,43 +394,56 @@ export const designGateway = {
   },
 
   projectEvents(projectId: string, handlers: ProjectEventHandlers, options: ProjectEventsOptions = {}) {
-    const source = new EventSource(projectEventsUrl(projectId, options));
+    const controller = new AbortController();
     let settled = false;
-    const readProject = (event: MessageEvent) => {
-      const payload = JSON.parse(event.data) as { project: Project };
+    const readProject = (data: string) => {
+      const payload = JSON.parse(data) as { project: Project };
       return payload.project;
     };
-
-    source.addEventListener("project", (event) => handlers.onProject?.(readProject(event as MessageEvent)));
-    source.addEventListener("thinking", (event) => handlers.onThinking?.(JSON.parse((event as MessageEvent).data) as AgentMessage));
-    source.addEventListener("text_extraction", (event) => handlers.onTextExtraction?.(JSON.parse((event as MessageEvent).data) as ExtractNodeTextResponse));
-    source.addEventListener("done", (event) => {
+    const close = () => {
       settled = true;
-      handlers.onDone?.(readProject(event as MessageEvent));
-      source.close();
-    });
-    source.addEventListener("timeout", (event) => {
-      settled = true;
-      handlers.onTimeout?.(readProject(event as MessageEvent));
-      source.close();
-    });
-    source.addEventListener("stream_error", (event) => {
-      settled = true;
-      if ((event as MessageEvent).data) {
-        const payload = JSON.parse((event as MessageEvent).data) as { error?: string };
-        handlers.onError?.(new Error(payload.error ?? "Event stream failed"));
-      } else {
-        handlers.onError?.(new Error("Event stream failed"));
+      controller.abort();
+    };
+    const onEvent = (event: string, data: string) => {
+      if (event === "project") {
+        handlers.onProject?.(readProject(data));
+        return;
+      }
+      if (event === "thinking") {
+        handlers.onThinking?.(JSON.parse(data) as AgentMessage);
+        return;
+      }
+      if (event === "text_extraction") {
+        handlers.onTextExtraction?.(JSON.parse(data) as ExtractNodeTextResponse);
+        return;
+      }
+      if (event === "done") {
+        settled = true;
+        handlers.onDone?.(readProject(data));
+        controller.abort();
+        return;
+      }
+      if (event === "timeout") {
+        settled = true;
+        handlers.onTimeout?.(readProject(data));
+        controller.abort();
+        return;
+      }
+      if (event === "stream_error") {
+        settled = true;
+        const payload = data ? (JSON.parse(data) as { error?: string }) : {};
+        handlers.onError?.(new Error(payload.error ?? "Event stream failed"));
+        controller.abort();
       }
-      source.close();
-    });
-    source.onerror = () => {
-      if (settled || source.readyState === EventSource.CLOSED) return;
-      handlers.onError?.(new Error("Event stream failed"));
-      source.close();
     };
 
-    return () => source.close();
+    void streamProjectEvents(projectEventsUrl(projectId, options), controller.signal, onEvent).catch((error: Error) => {
+      if (settled || controller.signal.aborted) return;
+      settled = true;
+      handlers.onError?.(error);
+    });
+
+    return close;
   },
 
   saveCanvas(
@@ -507,6 +521,7 @@ export const designGateway = {
     if (upload.uploadUrl && !upload.uploadUrl.includes("/memory-assets/")) {
       await fetch(upload.uploadUrl, {
         method: "PUT",
+        credentials: "omit",
         headers: upload.headers,
         body: file
       });
@@ -866,3 +881,56 @@ function projectEventsUrl(projectId: string, options: ProjectEventsOptions) {
   const query = params.toString();
   return `/api/projects/${projectId}/events${query ? `?${query}` : ""}`;
 }
+
+async function streamProjectEvents(url: string, signal: AbortSignal, onEvent: (event: string, data: string) => void) {
+  const headers = new Headers();
+  Object.entries(authHeaders()).forEach(([key, value]) => headers.set(key, value));
+  const response = await fetch(url, {
+    headers,
+    signal,
+    cache: "no-store",
+    credentials: "omit"
+  });
+  if (!response.ok) {
+    const payload = await response.json().catch(() => ({ error: response.statusText }));
+    throw createApiFailure("design", response, payload);
+  }
+  if (!response.body) {
+    throw new Error("Event stream failed");
+  }
+
+  const reader = response.body.pipeThrough(new TextDecoderStream()).getReader();
+  let buffer = "";
+  try {
+    for (;;) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      buffer += value;
+      const parts = buffer.split(/\r?\n\r?\n/);
+      buffer = parts.pop() ?? "";
+      parts.forEach((part) => emitServerSentEvent(part, onEvent));
+    }
+    if (buffer.trim()) {
+      emitServerSentEvent(buffer, onEvent);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+}
+
+function emitServerSentEvent(raw: string, onEvent: (event: string, data: string) => void) {
+  let event = "message";
+  const data: string[] = [];
+  raw.split(/\r?\n/).forEach((line) => {
+    if (line.startsWith("event:")) {
+      event = line.slice("event:".length).trim();
+      return;
+    }
+    if (line.startsWith("data:")) {
+      data.push(line.slice("data:".length).trimStart());
+    }
+  });
+  if (data.length > 0) {
+    onEvent(event, data.join("\n"));
+  }
+}