feat: support JWT from query string for SSE endpoints

apps/server/src/auth/strategies/jwt.strategy.ts

@@ -2,12 +2,24 @@ import { Injectable } from '@nestjs/common';
 import { PassportStrategy } from '@nestjs/passport';
 import { ExtractJwt, Strategy } from 'passport-jwt';
 import { ConfigService } from '@nestjs/config';
+import { Request } from 'express';
 
 @Injectable()
 export class JwtStrategy extends PassportStrategy(Strategy) {
   constructor(config: ConfigService) {
     super({
-      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+      jwtFromRequest: ExtractJwt.fromExtractors([
+        // 1. Standard Bearer header (existing behavior)
+        ExtractJwt.fromAuthHeaderAsBearerToken(),
+        // 2. SSE fallback: query string ?token=
+        (req: Request) => {
+          const token = req?.query?.token;
+          if (typeof token === 'string' && token.length > 0) {
+            return token;
+          }
+          return null;
+        },
+      ]),
       ignoreExpiration: false,
       secretOrKey: config.get('JWT_SECRET', 'dorm-billing-jwt-secret-key-2024'),
     });