fix(api): address review on the event-loop streams

- Per-user SSE cap uses per-connection leases in a sorted set instead of
  a shared INCR/DECR counter with a TTL. A stream that outlived the TTL
  could let the counter expire, then decrement another stream's slot or
  drive the count negative. Leases refresh while a stream sends frames
  and age out when a stream dies without cleanup.
- Shielded cleanup is bounded per step: stream close and on_close in
  ClosingStreamingResponse, unsubscribe and close in AsyncTopic, lease
  release, and the replay-budget check, so a dead Redis connection can't
  hold a request or a graceful shutdown.
- Artifact downloads send an ASCII filename plus an RFC 5987 filename*
  for non-ASCII names, build headers before opening the file, and close
  disk handles off the event loop.
- Type hints and docstrings on the new helpers.

docsgpt/api/devices/session_events.py

@@ -39,10 +39,12 @@ _SSE_HEADERS = {
 
 
 def _error(code: str, status_code: int) -> JSONResponse:
+    """Return the ``{"success": false, "error": code}`` body the Flask device routes use."""
     return JSONResponse({"success": False, "error": code}, status_code=status_code)
 
 
 def _sse_event(name: str, payload: dict, event_id: int) -> str:
+    """Encode one SSE record with an event name, an id and a JSON data line."""
     return (
         f"event: {name}\n"
         f"id: {event_id}\n"