fix: SSE flusher support, null-safe API responses

- Add Flush() to statusRecorder so SSE works through logging middleware
- Return empty array instead of null for empty project lists
- Fixes 500 on /api/events and null.length crash on dashboard

internal/api/middleware.go

@@ -72,3 +72,10 @@ func (r *statusRecorder) WriteHeader(code int) {
 	r.status = code
 	r.ResponseWriter.WriteHeader(code)
 }
+
+// Flush delegates to the underlying ResponseWriter if it supports http.Flusher (needed for SSE).
+func (r *statusRecorder) Flush() {
+	if f, ok := r.ResponseWriter.(http.Flusher); ok {
+		f.Flush()
+	}
+}

internal/api/projects.go

@@ -27,6 +27,9 @@ func (s *Server) listProjects(w http.ResponseWriter, r *http.Request) {
 		respondError(w, http.StatusInternalServerError, "failed to list projects: "+err.Error())
 		return
 	}
+	if projects == nil {
+		projects = []store.Project{}
+	}
 	respondJSON(w, http.StatusOK, projects)
 }