Create packages/sse-client wrapping eventsource-client as the
monorepo's shared SSE transport, exporting subscribeToEventSource()
(raw message/connect/disconnect/reconnect callbacks, headers,
credentials defaulting to 'include', external AbortSignal, fetch
override, cleanup closes the client) and a thin useEventSource() React
hook, so Times Square today and Semaphore later share one SSE
primitive.

Key decisions:
- No payload parsing/validation in this layer; messages are delivered
  raw (EventSourceMessage) and consumers own their schemas.
- External AbortSignal is wired to client.close(); an already-aborted
  signal skips connecting entirely and returns a no-op cleanup.
- useEventSource reads options through a ref: only url changes
  reconnect; callback identity changes never do. url may be null to
  disable the subscription.
- No-build-step package (main/types point at src/index.ts), react
  ^18||^19 peer dep, eventsource-client sole runtime dep; added to
  transpilePackages in apps/squareone/next.config.js.

Next-iteration notes:
- Tests use a mocked FetchLike returning a ReadableStream SSE body
  (honoring init.signal with an AbortError); the helper is duplicated
  in both test files and could be shared if task #526 needs it.
- EventSourceMessage and FetchLike are re-exported from src/index.ts
  for consumers (times-square-client in #526).

Closes #525

Rebuild subscribeToHtmlEvents() on the shared subscribeToEventSource()
transport, dropping the unmaintained @microsoft/fetch-event-source
dependency while preserving the public SSE API exactly.

Key decisions:
- Zod validation, auto-abort on complete+html_hash, onComplete, and the
  structured Logger stay in this layer; the transport stays raw.
- Reconnect policy is the library default (automatic backoff honoring
  server retry:, including after 4xx); connection loss is surfaced via
  onError from onDisconnect, and scheduled reconnects are logged at
  debug level through the Logger.
- sse.test.ts mocks @lsst-sqre/sse-client at the module boundary and
  drives the captured callbacks directly, keeping the tests focused on
  this layer's semantics rather than transport behavior.
- Changeset is minor: no API change, but the reconnect-after-4xx
  behavior and transpile graph (sse-client source) change for consumers.

Next-iteration notes:
- Task #527 (app provider refactor) can rely on subscribeToHtmlEvents
  signatures being unchanged; @lsst-sqre/sse-client is already in
  apps/squareone transpilePackages from task #525.
- @microsoft/fetch-event-source still remains in apps/squareone
  package.json; #527 removes the last repo reference.

Closes #526

Rewrite TimesSquareHtmlEventsProviderClient on the packaged
subscribeToHtmlEvents() from @lsst-sqre/times-square-client, deleting the
duplicated inline fetchEventSource logic and the local HtmlEvent type. The
app's SSE path now gains Zod validation, credentials: 'include', and
automatic reconnection from the shared transport, and
@microsoft/fetch-event-source is removed from the entire repo.

Key decisions:
- The provider's isClient gate was dropped: the component is loaded via
  next/dynamic with ssr: false and useEffect never runs on the server, so
  the extra state only forced a redundant effect cycle.
- The URL query string from TimesSquareUrlParametersContext is converted to
  a params record with URLSearchParams so subscribeToHtmlEvents owns URL
  construction (no more manual `?${qs}` concatenation).
- The dev mock github/[...tsSlug] route drifted from the client's PageSchema
  (string description, missing date_added/uploader_username), which Zod-failed
  useTimesSquarePage and blocked the end-to-end SSE check; it was minimally
  updated to conform.

Next-iteration notes:
- The dev mock /times-square/api/v1/github contents route still fails
  GitHubContentsRootSchema validation (console ZodError on Times Square pages
  in dev; sidebar nav 404s). Pre-existing drift, out of scope here.

Closes #527

Update the vendored Times Square OpenAPI spec to v0.24.0 and fix the dev
mock API routes that had drifted from it:

- The GitHub contents-tree mocks (github and github-pr) omitted the
  required contents array on leaf page nodes, which failed
  GitHubContentsRootSchema/GitHubPrContentsSchema validation and broke
  the sidebar nav in dev.
- The pages/[page] and github-pr page-metadata mocks still returned a
  plain-string description and lacked date_added, uploader_username,
  html_events_url, and github required by PageSchema.

Mock payloads are now typed with the Page/GitHubContentsRoot/
GitHubPrContents types from @lsst-sqre/times-square-client for
compile-time conformance, and a new schema-conformance test parses
every JSON mock route with the package's Zod schemas so future drift
fails in CI instead of as a runtime ZodError in dev.