- Add sseToken exchange flow (POST /sse-token → GET /events?sseToken=) replacing JWT-in-URL
- Server folder outputs stay on server; IDB holds only metadata (serverOutputFilenames)
- Trigger immediate processing on upload via POST /server-folder/{id}/process
- Scheduled scan skips session-managed folders (on-demand only)
- Per-folder output TTL with hourly cleanup; delete-on-download fires on local FS export only
- .ready marker prevents partial-upload race in collectFilesForProcessing
- Fix concurrent map mutation in cleanupOldJobs with removeIf
- Update Playwright tests to use sseToken flow and trigger endpoint