fix: SSE flusher support, null-safe API responses

- Add Flush() to statusRecorder so SSE works through logging middleware
- Return empty array instead of null for empty project lists
- Fixes 500 on /api/events and null.length crash on dashboard

internal/api/projects.go

@@ -27,6 +27,9 @@ func (s *Server) listProjects(w http.ResponseWriter, r *http.Request) {
 		respondError(w, http.StatusInternalServerError, "failed to list projects: "+err.Error())
 		return
 	}
+	if projects == nil {
+		projects = []store.Project{}
+	}
 	respondJSON(w, http.StatusOK, projects)
 }