fix(stream): remove completed/errored streams from registry after buffer TTL

[MarioCadenas]

Problem (memory leak, High)

Every SSE stream that finished while its original client was still connected — the normal case — stayed in the StreamRegistry forever, retaining its EventRingBuffer (up to 100 events x 1MB each), generator, abort controller, and trace context. Since every analytics query is one SSE stream whose final event is the full result set, a busy server accumulated up to maxActiveStreams (1,000) full query results in heap.

Leak mechanics

• Success path: _processGeneratorInBackground set isCompleted = true, called _closeAllClients() (which only calls res.end() — the close event fires asynchronously), then immediately called _cleanupStream. At that point clients.size > 0, so no removal was ever scheduled.
• Close handler: the handler installed in _createNewStream deleted the client from the set but had no cleanup-scheduling branch for completed streams — only _attachToExistingStream's close handler (the reconnect path) had one. So the leak hit every stream whose client never reconnected.
• Error path: never scheduled cleanup at all.
• streamDefaults.cleanupInterval and maxPersistentBuffers were defined but referenced nowhere — there was no periodic sweeper to catch any of this.

Fix

• Factored the TTL-based removal scheduling into a single helper, _scheduleRemovalAfterTTL, and call it from every termination path: both close handlers (_createNewStream and _attachToExistingStream), the success path, the client-abort path, and the error path. The helper no-ops unless the stream is finished (isCompleted) and has no connected clients, so whichever of completion / last-disconnect happens second does the scheduling.
• Reconnect replay is preserved: the event buffer stays in the registry for bufferTTL (default 10 min) after the last client disconnects. A reconnect during the TTL window refreshes lastAccess, which makes any pending timer a no-op; a fresh TTL starts when that client disconnects again.
• Cleanup timers are unref()'d so they never keep the process alive.
• Decision on the dead config keys: removed cleanupInterval and maxPersistentBuffers from streamDefaults rather than wiring a periodic sweeper. The per-stream timers now cover every termination path (and abortAll() clears the registry on shutdown), and a sweeper would require adding iteration APIs to stream-registry.ts, which a sibling PR is modifying (capacity-eviction fix) — kept out of this change to avoid merge conflicts. The optional fields on the public StreamConfig type in shared are left as-is (they were already no-ops); they can be dropped in a follow-up.

Tests

New registry cleanup after stream termination suite (fake timers):

• completed stream + client disconnect → still present at TTL - 1ms, removed at TTL
• errored stream + client disconnect → likewise
• errored stream whose client disconnected mid-stream → removed after TTL
• reconnect within the TTL window still replays buffered events, the stale timer from the first disconnect no-ops, and removal happens a full TTL after the second disconnect
• a completed stream with a still-connected client is never removed

Verified: pnpm install, pnpm build, pnpm -r typecheck, pnpm check:fix all pass; vitest run packages/appkit/src/stream/tests/ → 91/91 passing (33 in stream.test.ts, including 5 new).

This pull request and its description were written by Isaac.