fix(web): heid-review findings — SSE lifecycle teardown + test-shape gaps (v0.19.3)

Cross-frontier panel (Gróa/Hulda/Regin) on the v0.19.2 web surface, triaged:

- FIX (Gróa #1, drift): the turn EventSource `onerror` (raw transport drop)
  now calls hideThinkingNote() — a drop mid-reasoning no longer leaves the
  "<Agent> is pondering…" line + its setInterval running (INV-LIFECYCLE).
- FIX (Gróa #4 + Hulda #1, convergent drift): openAdminEvents now closes the
  EventSource + clears state.adminES on `stream_error` (server signalled end)
  and on a PERMANENT onerror (readyState CLOSED) — native EventSource no longer
  auto-reconnects into a retry loop; transient CONNECTING drops still reconnect.
- TEST (Gróa #2 + Hulda #3): test_routes_registered asserts the 3 new routes;
  test_state_attached asserts app.state.admin_key (create_app POST-001/002).
- TEST (Gróa #3 + Regin #3): AdminEvents stream_error-on-connect-failure test —
  upstream non-200 -> exactly one `stream_error` frame, then ends (POST-003).
- CONTRACT (Hulda #2 + Regin #2, accepted): clarified the Tools inventory
  renders NAMES only by design (descriptions live in the BifrostState pane);
  code unchanged. Also lands the web_debug_surface contract as the trail.

Accepted-no-op: 403-bifrost / non-404-tools tests (identical code path to the
tested 404). Panel found ZERO functional server-side drift; INV-004 escaping
confirmed clean across the new panes. 60 web tests pass; JS + ruff clean.

tests/test_web_server.py

@@ -625,6 +625,10 @@ class TestCreateAppShape:
             "/", "/version", "/api/agents", "/api/sessions",
             "/api/agents/{agent_id}/persona_state",
             "/api/affect/{agent_id}",
+            # v0.19.2 debug-surface parity (create_app POST-002)
+            "/api/sessions/{session_id}/tools",
+            "/api/sessions/{session_id}/bifrost",
+            "/api/admin/events",
             "/api/turns/{session_id}", "/api/turns/{session_id}/stream",
             "/api/turns/{session_id}/cancel",
         ):
@@ -633,10 +637,14 @@ class TestCreateAppShape:
         assert "/static" in paths
 
     def test_state_attached(self) -> None:
-        """state_attached [trace]: app.state.turn_registry is empty dict."""
+        """state_attached [trace]: app.state.turn_registry is empty dict; admin_key stored."""
         from ratatoskr.web.server import create_app
         app = create_app(_mock_client_factory())
         assert app.state.turn_registry == {}
+        # create_app POST-001: admin_key defaults None (admin routes fail-visible)
+        assert app.state.admin_key is None
+        app2 = create_app(_mock_client_factory(), admin_key="adm-key")
+        assert app2.state.admin_key == "adm-key"
 
     def test_factory_stored(self) -> None:
         """factory_stored [trace]: app.state.client_factory is the same callable."""
@@ -1182,3 +1190,16 @@ class TestAdminEventsEndpoint:
         assert "system.degraded" in body              # system.* → forwarded
         assert "system.heartbeat" not in body         # heartbeat → dropped
         assert "turn.started" not in body             # other session → dropped
+
+    @respx.mock
+    def test_stream_error_on_connect_failure(self) -> None:
+        """error: upstream admin SSE non-200 -> ONE stream_error frame, stream ends (POST-003)."""
+        respx.get("https://w.example/admin/events").mock(
+            return_value=httpx.Response(500, content=b"boom")
+        )
+        from ratatoskr.web.server import create_app
+        app = create_app(_mock_client_factory(), admin_key="adm-key")
+        body = TestClient(app).get("/api/admin/events?session_id=s-1").text
+        assert "event: stream_error" in body
+        assert "SseConnectFailed" in body
+        assert body.count("event: stream_error") == 1  # exactly one, then ends