add basic authentication to SSE endpoint / logger plugin

[xsalefter]

• Implements the basic auth for SSE endpoint : 2b3b824
• Add demo : d8573ec

[Copilot]

🟡 Changes recommended

Authentication interoperability, rate-limiter performance, and demo correctness issues remain unresolved.

5 open findings

• btoa fails for non-Latin-1 credentials · New
• Duplicate message handlers append every log entry twice · New
• Rejects valid case-insensitive HTTP authentication schemes · New
• High-cardinality failures trigger repeated O(n) cleanup scans · New
• Authentication scope note incorrectly covers all plugin endpoints · New

What changed in this PR

Adds HTTP Basic authentication and rate limiting to the logger SSE endpoint, with tests and a browser demo.

Changes:

• Registers an RBAC-backed authentication filter.
• Adds per-IP failure rate limiting and unit tests.
• Documents an authenticated browser SSE client.

File	Description
BasicAuthFilter.java	Implements authentication and rate limiting.
Activator.java	Registers the filter with the logger plugin.
TestBasicAuthFilter.java	Tests filter behavior.
TestBasicCredentials.java	Tests credential parsing.
TestFailureRateLimiter.java	Tests rate-limit behavior.
html-sse-demo.md	Provides an authenticated SSE demo.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The cleanup throttle has a concurrency race, and the vendored dependency lacks its required license notice.

2 open findings

• Make cleanup throttling atomic under concurrent requests · New
• Include the full upstream MIT license notice · New

5 resolved since last review

• High-cardinality failures trigger repeated O(n) cleanup scans
• Rejects valid case-insensitive HTTP authentication schemes
• Duplicate message handlers append every log entry twice
• btoa fails for non-Latin-1 credentials
• Authentication scope note incorrectly covers all plugin endpoints

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

The vendored dependency lacks its required license notice, and documentation misstates the supported authentication paths.

6 open findings

• Clarify that authenticated Shiro sessions can bypass Basic credentials · New
• Include the required EventSource upstream license notice · New
• Update comment to reflect session-based authentication · New
• Document both Basic and Shiro session authentication paths · New
• Correct Clock package to java.time.Clock · New
• Include the full upstream MIT license notice

1 resolved since last review

• Make cleanup throttling atomic under concurrent requests

🧠 Review effort: Balanced