fix: SSE sync indicator stuck on 'Connexion...' (3 fixes)

1. Move initSyncStatus() AFTER auth check — EventSource was connecting
   before the access_token cookie was available, causing 401 errors.

2. Reconnect SSE after login — Login form handler now calls
   IndexUpdateManager.connect() + showWelcome() after successful auth.

3. SSESafeGZipMiddleware — GZip buffering breaks Server-Sent Events
   streaming. Custom middleware subclass skips compression for
   /api/events endpoint (path-based bypass).

backend/main.py

@@ -556,8 +556,24 @@ async def lifespan(app: FastAPI):
 app = FastAPI(title="ObsiGate", version="1.4.0", lifespan=lifespan)
 
 # GZip compression — reduces bandwidth by ~70% for text responses
+# Custom wrapper: skip compression for SSE streams (/api/events)
 from fastapi.middleware.gzip import GZipMiddleware
-app.add_middleware(GZipMiddleware, minimum_size=1000)
+from starlette.types import Scope, Receive, Send
+
+class SSESafeGZipMiddleware(GZipMiddleware):
+    """GZip middleware that skips SSE (Server-Sent Events) streams.
+
+    GZip buffering breaks incremental streaming required by SSE.
+    We detect SSE endpoints by path and bypass compression entirely.
+    """
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] == "http" and scope.get("path") == "/api/events":
+            # Bypass GZip: passthrough directly to the inner app
+            await self.app(scope, receive, send)
+        else:
+            await super().__call__(scope, receive, send)
+
+app.add_middleware(SSESafeGZipMiddleware, minimum_size=1000)
 
 # Security headers on all responses
 app.add_middleware(SecurityHeadersMiddleware)