fix(flags): SSE stream endpoint + client — pass productId via query string

EventSource API cannot set custom headers, so the SSE /flags/stream
endpoint and feature-flag-client were broken for streaming mode:
- Server: accept productId and token from query string as fallback
  when x-product-id / authorization headers are absent
- Client: pass productId (and optional auth token) as query params
  when constructing the EventSource URL

packages/feature-flag-client/src/client.ts

@@ -194,7 +194,12 @@ export function createFeatureFlagClient(config: FeatureFlagClientConfig): Featur
       return;
     }
 
-    const url = `${baseUrl}/flags/stream`;
+    const parts = [`productId=${encodeURIComponent(productId)}`];
+    if (getAccessToken) {
+      const token = getAccessToken();
+      if (token) parts.push(`token=${encodeURIComponent(token)}`);
+    }
+    const url = `${baseUrl}/flags/stream?${parts.join('&')}`;
     eventSource = new globalThis.EventSource(url);
 
     eventSource.onmessage = event => {

services/platform-service/src/modules/flags/routes.ts

@@ -524,6 +524,14 @@ export async function flagRoutes(app: FastifyInstance) {
   // ── SSE stream ────────────────────────────────────────────────────────
 
   app.get('/flags/stream', async (req, reply) => {
+    // EventSource cannot set custom headers, so accept productId + token from query string
+    const qs = req.query as { productId?: string; token?: string };
+    if (qs.productId && !req.headers['x-product-id']) {
+      (req.headers as Record<string, string>)['x-product-id'] = qs.productId;
+    }
+    if (qs.token && !req.headers['authorization']) {
+      (req.headers as Record<string, string>)['authorization'] = `Bearer ${qs.token}`;
+    }
     const productId = getRequestProductId(req);
 
     reply.raw.writeHead(200, {