refactor(open-sse): #11 — dedupe client-facing SSE_HEADERS_CORS

Gom block SSE headers + CORS lặp ở streamingHandler + responsesHandler
vào sseConstants.SSE_HEADERS_CORS. Codex format-routing giữ nguyên
(logic-driven theo kim chỉ nam DATA/LOGIC docs 07).

Co-authored-by: Cursor <cursoragent@cursor.com>

open-sse/utils/sseConstants.js

@@ -13,3 +13,11 @@ export const SSE_HEADERS_NO_BUFFER = {
   "Cache-Control": "no-cache",
   "X-Accel-Buffering": "no"
 };
+
+// Variant for client-facing SSE responses (adds permissive CORS)
+export const SSE_HEADERS_CORS = {
+  "Content-Type": "text/event-stream",
+  "Cache-Control": "no-cache",
+  "Connection": "keep-alive",
+  "Access-Control-Allow-Origin": "*"
+};