Feature: Session-scoped bearer token for frontend SSE streaming

[PhilippeLaval]

When building a web app on Managed Agents, the natural pattern is:

1. Backend creates session (with API key, vault, agent)
2. Backend returns a scoped token to the frontend
3. Frontend streams events directly from Anthropic (no proxy needed)

Currently every request requires the full API key, forcing all traffic through a backend proxy — adding latency, infra cost, and complexity for what is essentially a passthrough.

A short-lived, session-scoped token (similar to S3 presigned URLs or Stripe ephemeral keys) would solve this cleanly.
-+-