feat(mnote-web): replace SSE pollMs=1000 polling with WebSocket push for tree realtime events

## Problem
Convex backend RSS grew to 7.7G due to ~17 HTTP POST /api/query/min
(32K+ in 32h) from the SSE polling loop in /api/tree/events?pollMs=1000.
Each poll triggered a Convex query even when nothing changed.

## Root Cause
The tree live EventSource client polled every 1s via SSE, calling
load_stream_overview() → execute_runtime_query_via_convex() → Convex
POST /api/query on every cycle, regardless of workspace state.

## Solution
Replace polling with push: add a `stream_delta_tx` broadcast channel
that publishes after every Convex mutation, consumed by WebSocket and
SSE endpoints for push-only delivery.

### Server-side
- **app.rs**: Add `stream_delta_tx: broadcast::Sender<Value>` to AppState
- **command_support.rs**: `execute_runtime_command_via_convex_with_artifacts`
  now takes `&AppState` (was `&AppConfig`) and pushes `{"kind":"command_committed",...}`
  to `stream_delta_tx` after every successful mutation
- **ws.rs**: Rewrite `handle_socket` with `tokio::select!` subscribing to
  `stream_delta_tx`; pushes delta events to WS clients on mutation, handles
  client `resync` requests for fresh snapshots
- **sse.rs**: `tree_events` endpoint now subscribes to both `block_delta_tx`
  and `stream_delta_tx`; when broadcast channels are available, runs in
  push-only mode (250ms heartbeat, no Convex query). Polling degrades to
  60s safety net. Keeps backward compatibility for non-WS clients.

### Client-side
- **layout.rs**: Bootstrap JSON now defaults to `transport: "convex-command-log-ws"`
  with `wsEndpoint: "/api/realtime/ws"`. TREE_LIVE_CONTROLLER_JS extended
  with `startWithWebSocket()` supporting snapshot/delta/resync/lagged-hint
  events; auto-fallback to SSE on WS failure after 2s.

### Caller updates (17 call sites)
- documents.rs, mindmap_api.rs, resource_trash.rs, tree.rs
- hermes_tools/{artifact,block,page}.rs
All updated from `state.config()` to `&state` for the new signature.

## Verification
- `cargo build` + `cargo test`: 295/298 passed (3 pre-existing failures)
- Browser smoke: page loaded → transport=convex-command-log-ws, status=connected
- Convex logs: 0 POST /api/query in 2min with page idle (vs ~17/min before)
- Initial burst: 8 queries on page load (normal), then silence

rust/crates/mnote-web/src/routes/command_support.rs

@@ -1,9 +1,10 @@
-use crate::app::AppConfig;
+use crate::app::{AppConfig, AppState};
 use crate::context::RequestContext;
 use crate::error::WebError;
 use crate::transport::convex::{
     execute_convex_command_plan, execute_convex_command_plan_with_artifacts, ConvexCommandExecution,
 };
+use serde_json::json;
 use bridge_runtime::{
     execute_runtime_input, RuntimeActorWire, RuntimeBridgeContextWire, RuntimeCommandEnvelopeWire,
     RuntimeCommandExecutionPlan, RuntimeExecutionPlan, RuntimeInput, RuntimeSourceWire,
@@ -73,7 +74,7 @@ pub async fn execute_runtime_command_via_convex(
 }
 
 pub async fn execute_runtime_command_via_convex_with_artifacts(
-    config: &AppConfig,
+    state: &AppState,
     context: &RequestContext,
     effective_workspace_id: Option<&str>,
     command: RuntimeCommandEnvelopeWire,
@@ -89,8 +90,30 @@ pub async fn execute_runtime_command_via_convex_with_artifacts(
         return Err(WebError::internal("runtime command 未返回 command plan").with_context(context));
     };
 
-    execute_convex_command_plan_with_artifacts(config, context, &runtime_context, &command, &plan)
-        .await
+    let execution = execute_convex_command_plan_with_artifacts(
+        state.config(),
+        context,
+        &runtime_context,
+        &command,
+        &plan,
+    )
+    .await?;
+
+    // Push stream delta notification via broadcast for WebSocket/SSE push consumers
+    let workspace_id = effective_workspace_id
+        .map(ToOwned::to_owned)
+        .or_else(|| context.workspace.workspace_id.clone());
+    let delta = json!({
+        "kind": "command_committed",
+        "commandName": command.name,
+        "commandId": command.command_id,
+        "workspaceId": workspace_id,
+        "requestId": context.trace.request_id,
+        "traceId": context.trace.trace_id,
+    });
+    let _ = state.stream_delta_tx.send(delta);
+
+    Ok(execution)
 }
 
 pub fn build_tree_target(