merge

feat(broadcast): push sessionStateChanged on busy/free transitions

ci: auto-sync main to HF Space pollen-robotics/reachy_mini_central

feat(rate-limit): per-peer sliding window + lease 30s for production-grade signaling

feat(central): tight liveness contract + welcome negotiation + observability

fix(central): liveness now requires inbound traffic, not SSE keepalive

fix(central): refresh peer lease on SSE keepalive yield

feat: lifecycle robustness (TTL, withdraw, install_id last-writer-wins)

harden: strict Bearer-only, sampled deprecation, CORS fix, tests

feat: accept HF token via Authorization header (keep Query as deprecated fallback)

fix: forward endSession reason through handle_end_session

fix: release session lock on peer disconnect + missing status import

Add /api/robot-status endpoint for passive busy/app queries

Add concurrency gate: reject new sessions while robot is busy

Add owner-based filtering and rate limiting for security

Switch from WebSocket to SSE+HTTP for browser compatibility

Add first-message auth for browser WebSocket clients

Remove hf_oauth - server has its own auth

Add CORS middleware for browser clients

Fix WebSocket close before accept and add connection logging

Trigger rebuild

Enable HF OAuth + accept Bearer token in headers

Support HF proxy auth for logged-in users

Fix list response format for GStreamer compatibility

Fix: remove __pycache__ and add .gitignore

Add HuggingFace token authentication

Add WebRTC signaling server for baby camera

initial commit