feat: Replace SSE with WebSocket for UI notifications (#36965)

* Closes #36942
* Fixes #19265 

Replaces the SSE-based push channel (`/user/events`) with a WebSocket
endpoint (`/-/ws`).

### What changes

- **New `/-/ws` endpoint** (authenticated). One WebSocket per origin,
shared across tabs via a single `SharedWorker`.
- **Pubsub broker** (`services/pubsub`) for fan-out by topic, behind a
`Broker` interface. `MemoryBroker` is the default (single process); a
Redis backend is available for multi-process setups, configured via
`[websocket].PUBSUB_TYPE` / `PUBSUB_CONN_STR`. The internal Gitea queue
was not usable here because it has FIFO/single-consumer semantics.
- **Push-only event production.** Events are emitted by write-triggered
notifiers — `NotificationCountChange`, `PublishStopwatchesForUser`, and
the logout publisher — wired into the existing `notify.Notifier`
interface. No server-side pollers.
- **Typed pub/sub on the client.** `web_src/js/modules/worker.ts` is a
singleton transport; features subscribe per event type via
`onUserEvent('notification-count', cb)` instead of branching on
`event.data.type`.
- **Wire contract** (`UserEventType` union) is shared between the worker
and consumers via `web_src/js/types.ts`, kept in sync with
`services/websocket/events.go`.
- **Client-side periodic polling fallback** kicks in only when the
WebSocket cannot be established (e.g. proxy blocks WS, browser lacks
module-SharedWorker support).

### What's removed

- `modules/eventsource` (SSE manager, run loop, messenger).
- `/user/events` route and `tests/integration/eventsource_test.go`.
- All server-side polling for stopwatches and notification counts.

### Stopwatch multi-tab fix

The navbar stopwatch icon was previously rendered conditionally on `{{if
$activeStopwatch}}`, so tabs loaded before the timer started had no DOM
element to update. The icon and popup are now always rendered (toggled
with `tw-hidden`), and the start/stop/cancel handlers POST silently so
all open tabs reflect the change in real time.

### Deployment note

WebSocket needs the upgrade headers to pass through a reverse proxy,
e.g. for nginx:

```nginx
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
```

Without them the WebSocket cannot be established, and after 3
consecutive failed opens the shared worker signals `push-unavailable`:
the notification count and stopwatch fall back to periodic polling on
the existing `[ui.notification]` timeouts. Real-time push is lost, the
features keep working. The reverse-proxy docs need the same note (see
the `docs-update-needed` label).

---------

Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Epid <rexmrj@gmail.com>

services/pubsub/redis_test.go

@@ -0,0 +1,71 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package pubsub
+
+import (
+	"testing"
+	"time"
+
+	"gitea.dev/modules/test"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestRedisBroker runs the shared broker scenarios against a real Redis-backed
+// RedisBroker, plus the backend-specific ones. Delivery crosses a Redis
+// round-trip (hence the wider timeout) and HasTopicSubscribers answers
+// conservatively true, so subscriber tracking is not exact.
+// One redis-server is shared by all of them; starting one per test dominated
+// the package runtime.
+func TestRedisBroker(t *testing.T) {
+	redisConn := test.PrepareTestRedis(t)
+
+	newBroker := func(t *testing.T) Broker {
+		broker, err := NewRedisBroker(redisConn)
+		require.NoError(t, err)
+		return broker
+	}
+	testBrokerBasic(t, newBroker, 2*time.Second)
+
+	// RedisBroker cannot see other processes' subscribers, so it answers true even
+	// with none locally rather than risk dropping a push.
+	t.Run("HasTopicSubscribersWithoutAny", func(t *testing.T) {
+		assert.True(t, newBroker(t).HasTopicSubscribers("topic"))
+	})
+
+	// RedisBroker tears down its per-topic Redis subscription and internal
+	// state once the last local subscriber cancels.
+	t.Run("CancelCleansTopicState", func(t *testing.T) {
+		b := newBroker(t).(*RedisBroker)
+		ch, cancel := b.Subscribe("topic")
+		cancel()
+
+		_, ok := <-ch
+		assert.False(t, ok, "channel must be closed after cancel")
+
+		b.mu.RLock()
+		_, present := b.topics["topic"]
+		b.mu.RUnlock()
+		assert.False(t, present, "topic state must be removed after last subscriber cancels")
+	})
+
+	// Two RedisBroker instances sharing one Redis simulate two Gitea processes -
+	// a publish on one must reach a subscriber on the other.
+	t.Run("CrossBroker", func(t *testing.T) {
+		publisher, subscriber := newBroker(t), newBroker(t)
+
+		ch, cancel := subscriber.Subscribe("topic")
+		defer cancel()
+
+		publisher.Publish("topic", []byte("cross-process"))
+
+		select {
+		case msg := <-ch:
+			assert.Equal(t, []byte("cross-process"), msg)
+		case <-time.After(2 * time.Second):
+			t.Fatal("subscriber on second broker did not receive message")
+		}
+	})
+}