feat(v1.1.6): realtime channels + v1.1.5 follow-ups + version bumps

Server-side realtime SSE on per-app pub/sub topics, plus the three
v1.1.5 follow-ups and the version bumps.

Realtime:
- topics registry (0021) + admin endpoints + Capability::AppTopicManage
  (-> app:admin; no new scope).
- GET /realtime/topics/{topic} SSE endpoint (orchestrator-core data
  plane): Host -> app, RealtimeAuthority gate (404 missing/internal,
  401 bad/absent token), broadcast::Receiver stream + heartbeat.
- RealtimeBroadcaster / RealtimeEvent / RealtimeAuthority traits
  (picloud-shared); InProcessBroadcaster + GC (orchestrator-core);
  DB-backed RealtimeAuthorityImpl (manager-core). Publish path fans out
  to in-process subscribers after the durable outbox commit (best-effort,
  panic-isolated).
- HMAC subscriber tokens (subscriber_token.rs) + app_secrets table (0022)
  + pubsub::subscriber_token SDK (schema 1.6 -> 1.7). TTL clamp + env
  overrides.
- Dashboard Topics tab (register/list/edit/delete, prominent external
  badge, flip confirmation).

v1.1.5 follow-ups:
- Empty blobs accepted (NewFile/FileUpdate::validate) + round-trip test.
- Orphan *.tmp.* sweeper (spawn_files_orphan_sweep).
- Dispatcher e2e tests, one per trigger kind (DATABASE_URL-gated).

Versions: workspace 1.1.6, SDK 1.7, dashboard 0.12.0. Schema-snapshot
golden re-blessed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Cargo.lock

@@ -1610,7 +1610,7 @@ dependencies = [
 
 [[package]]
 name = "picloud"
-version = "1.1.5"
+version = "1.1.6"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1636,7 +1636,7 @@ dependencies = [
 
 [[package]]
 name = "picloud-cli"
-version = "1.1.5"
+version = "1.1.6"
 dependencies = [
  "anyhow",
  "assert_cmd",
@@ -1657,7 +1657,7 @@ dependencies = [
 
 [[package]]
 name = "picloud-executor"
-version = "1.1.5"
+version = "1.1.6"
 dependencies = [
  "anyhow",
  "picloud-executor-core",
@@ -1669,7 +1669,7 @@ dependencies = [
 
 [[package]]
 name = "picloud-executor-core"
-version = "1.1.5"
+version = "1.1.6"
 dependencies = [
  "async-trait",
  "base64",
@@ -1693,7 +1693,7 @@ dependencies = [
 
 [[package]]
 name = "picloud-manager"
-version = "1.1.5"
+version = "1.1.6"
 dependencies = [
  "anyhow",
  "picloud-manager-core",
@@ -1705,7 +1705,7 @@ dependencies = [
 
 [[package]]
 name = "picloud-manager-core"
-version = "1.1.5"
+version = "1.1.6"
 dependencies = [
  "argon2",
  "async-trait",
@@ -1733,7 +1733,7 @@ dependencies = [
 
 [[package]]
 name = "picloud-orchestrator"
-version = "1.1.5"
+version = "1.1.6"
 dependencies = [
  "anyhow",
  "picloud-orchestrator-core",
@@ -1745,7 +1745,7 @@ dependencies = [
 
 [[package]]
 name = "picloud-orchestrator-core"
-version = "1.1.5"
+version = "1.1.6"
 dependencies = [
  "async-trait",
  "axum",
@@ -1759,6 +1759,8 @@ dependencies = [
  "serde_json",
  "thiserror 1.0.69",
  "tokio",
+ "tokio-stream",
+ "tower",
  "tracing",
  "urlencoding",
  "uuid",
@@ -1766,13 +1768,17 @@ dependencies = [
 
 [[package]]
 name = "picloud-shared"
-version = "1.1.5"
+version = "1.1.6"
 dependencies = [
  "async-trait",
+ "base64",
  "chrono",
+ "hmac",
  "serde",
  "serde_json",
+ "sha2",
  "thiserror 1.0.69",
+ "tokio",
  "uuid",
 ]
 
@@ -2990,6 +2996,20 @@ dependencies = [
  "futures-core",
  "pin-project-lite",
  "tokio",
+ "tokio-util",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
 ]
 
 [[package]]