fix(js): keep standard sse same-origin

Require non-empty data-slhx-sse values at build time and have the standard runtime reject cross-origin EventSource URLs with slhx:sse-error instead of opening an implicit external stream.

req: push/006

req: diagnostics/002

slhx-build/src/lib.rs

@@ -1041,6 +1041,14 @@ fn reject_invalid_slhx_attr_values(path: &Path, attrs: &[SurfaceAttribute]) -> i
                     "expected a non-empty confirmation message",
                 ));
             }
+            "data-slhx-sse" if value.trim().is_empty() => {
+                return Err(invalid_slhx_value(
+                    path,
+                    &attr.name,
+                    value,
+                    "expected a non-empty same-origin SSE URL",
+                ));
+            }
             "data-slhx-debounce" | "data-slhx-throttle" | "data-slhx-every"
                 if !valid_duration(value) =>
             {
@@ -1578,6 +1586,12 @@ fn main() {{
                 "data-slhx-confirm",
                 "non-empty",
             ),
+            (
+                "empty-sse",
+                r#"<section data-slhx-root="notifications" data-slhx-sse=""></section>"#,
+                "data-slhx-sse",
+                "same-origin SSE URL",
+            ),
         ] {
             let base = test_dir(&format!("slhx-build-invalid-convention-{case}-test"));
             let templates = base.join("templates");