feat: event taxonomy, per-event notifier subscriptions, and per-topic timeline (#93)

[artyomsv]

Phase 1 — Event Spine

Part of #93. This is Phase 1 of 3 (event spine + history + per-event notifier
subscriptions). Phase 2 (server-side download-progress watcher) and Phase 3 (live
SSE transport) are intentionally out of scope and tracked under the same issue.

Design spec: docs/superpowers/specs/2026-06-25-event-types-and-live-updates-design.md
Plan: docs/superpowers/plans/2026-06-25-phase1-event-spine.md

What this adds

• internal/events package — a canonical event Type taxonomy and a per-type
  Policy (persist / notifiable / sse). Bus.Emit is the single fan-out point, teeing
  each event to up to three sinks: the topic_events history table, the notifier
  dispatcher, and an SSE seam (the SSE publisher is nil in Phase 1 — wired in Phase 3).
• topic_events history — the dormant table (migration 0001) is now wired via a
  TopicEvents repo (Record / ListForTopic / ListForUserSince).
• Typed emission — the scheduler emits check.started, check.completed,
  check.failed, release.found, download.submitted, session.expired; the topics
  HTTP handler emits topic.added on POST /topics.
• Per-event notifier subscriptions — notifiers can subscribe to specific events
  (new releases, sent-to-client, errors) via a new EventPicker UI. Existing
  ['updated','error'] notifier rows keep working unchanged via dispatcher legacy aliases.
• GET /api/v1/topics/{id}/events — ownership-checked history endpoint backing a new
  read-only per-topic event timeline in the UI.

Scope notes

• download.completed ("download finished") is a defined, notifier-subscribable event but
  is not emitted until Phase 2 (the progress watcher) — a subscription to it is inert
  for now. The CHANGELOG reflects this.
• The SSE publisher is nil; no live push yet.

Verification

• Backend: go build ./... && go vet ./... && go test -race ./... — all packages pass.
• Frontend: npm run typecheck && npm test && npm run build — green.
• Per-task review + an opus whole-branch review: no Critical/Important findings; verdict
  ready to merge. Highest-risk invariants (session-expiry delivery across modern +
  legacy notifier configs; legacy back-compat; topic-events ownership) are test-locked.

Optional follow-ups (deferred Minor, non-blocking)

• Restore the session.expired notification body guidance ("…solve the captcha in Marauder").
• Add a guard test asserting ALL_NOTIFIABLE_EVENTS contains session.expired.
• Delete now-dead notifiers.event.updated / notifiers.event.error i18n keys.