fix: address PR #1641 review comments (round 3)

- Fix migration version conflict: addSessionPlatformSourceColumn now uses v25
- Sanitize observation titles in file-context deny reason (strip newlines, limit length)
- Guard json_each() with LIKE '[%' check for legacy bare-path rows
- Guard /stream SSE endpoint with 503 before DB initialization
- Scope bun-runner signal exit handling to start subcommand only
- Normalize platformSource at route boundary in DataRoutes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/services/worker/http/routes/DataRoutes.ts

@@ -18,6 +18,7 @@ import { SessionManager } from '../../SessionManager.js';
 import { SSEBroadcaster } from '../../SSEBroadcaster.js';
 import type { WorkerService } from '../../../worker-service.js';
 import { BaseRouteHandler } from '../BaseRouteHandler.js';
+import { normalizePlatformSource } from '../../../../shared/platform-source.js';
 import { getObservationsByFilePath } from '../../../sqlite/observations/get.js';
 
 export class DataRoutes extends BaseRouteHandler {
@@ -281,7 +282,8 @@ export class DataRoutes extends BaseRouteHandler {
    */
   private handleGetProjects = this.wrapHandler((req: Request, res: Response): void => {
     const store = this.dbManager.getSessionStore();
-    const platformSource = req.query.platformSource as string | undefined;
+    const rawPlatformSource = req.query.platformSource as string | undefined;
+    const platformSource = rawPlatformSource ? normalizePlatformSource(rawPlatformSource) : undefined;
 
     if (platformSource) {
       const projects = store.getAllProjects(platformSource);
@@ -328,7 +330,8 @@ export class DataRoutes extends BaseRouteHandler {
     const offset = parseInt(req.query.offset as string, 10) || 0;
     const limit = Math.min(parseInt(req.query.limit as string, 10) || 20, 100); // Max 100
     const project = req.query.project as string | undefined;
-    const platformSource = req.query.platformSource as string | undefined;
+    const rawPlatformSource = req.query.platformSource as string | undefined;
+    const platformSource = rawPlatformSource ? normalizePlatformSource(rawPlatformSource) : undefined;
 
     return { offset, limit, project, platformSource };
   }

src/services/worker/http/routes/ViewerRoutes.ts

@@ -68,6 +68,14 @@ export class ViewerRoutes extends BaseRouteHandler {
    * SSE stream endpoint
    */
   private handleSSEStream = this.wrapHandler((req: Request, res: Response): void => {
+    // Guard: if DB is not yet initialized, return 503 before registering client
+    try {
+      this.dbManager.getSessionStore();
+    } catch {
+      res.status(503).json({ error: 'Service initializing' });
+      return;
+    }
+
     // Setup SSE headers
     res.setHeader('Content-Type', 'text/event-stream');
     res.setHeader('Cache-Control', 'no-cache');