feat(home): live updates via Mercure — server pushes device state to the PWA

Subscribe per-device with a Symfony Mercure hub: server publishes a fresh
device payload after every poll (200/304/204), every PATCH, and every
lock/unlock. The frontend opens one EventSource per device topic and
splats inbound JSON straight into the devices store — same shape as
GET /api/devices, so no envelope handling.

Topic: https://pictureframe.edholm.me/devices/{id}

Stack mirrors aqua-iq:
- symfony/mercure-bundle + config/packages/mercure.yaml
- App\Service\MercurePublisher (errors swallowed + logged; a flaky hub
  must not break a poll response)
- App\Service\DeviceSerializer extracted as the single source of truth
  for the wire shape (REST + Mercure share it)
- Frontend useDeviceMercure() composable: opens/closes EventSources to
  match the device list reactively, reconnects on hub-side closes
- SpaController exposes MERCURE_PUBLIC_URL via window.__PF_MERCURE_URL__

Production compose adds a dunglas/mercure container with Traefik labels
for pictureframe.edholm.me/.well-known/mercure (handled separately on
the host since the file isn't in this repo).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/Controller/DeviceImageController.php

@@ -7,6 +7,8 @@ namespace App\Controller;
 use App\Entity\Device;
 use App\Entity\RenderedAsset;
 use App\Enum\RenderStatus;
+use App\Service\DeviceSerializer;
+use App\Service\MercurePublisher;
 use App\Service\RotationService;
 use Doctrine\ORM\EntityManagerInterface;
 use Psr\Log\LoggerInterface;
@@ -21,9 +23,11 @@ class DeviceImageController extends AbstractController
 {
     public function __construct(
         #[Autowire('%kernel.project_dir%')]
-        private readonly string $projectDir,
-        private readonly RotationService $rotation,
-        private readonly LoggerInterface $logger,
+        private readonly string           $projectDir,
+        private readonly RotationService  $rotation,
+        private readonly LoggerInterface  $logger,
+        private readonly DeviceSerializer $serializer,
+        private readonly MercurePublisher $mercure,
     ) {}
 
     private function computeIntervalMs(Device $device): int
@@ -72,6 +76,13 @@ class DeviceImageController extends AbstractController
         // (they previously didn't flush at all — latent bug for lastSeenAt).
         $em->flush();
 
+        // Push the new state to any subscribed PWA clients. Done before we
+        // know which response branch we'll take — lastSeenAt + nextPollExpectedAt
+        // moved on every successful poll regardless of image change, and the
+        // PWA cares about both. If the 200 path mutates currentImage below,
+        // the second flush triggers a second publish to keep it accurate.
+        $this->mercure->publishDevice((int) $device->getId(), $this->serializer->serialize($device));
+
         // Locked image bypasses rotation entirely.
         $image = $device->getLockedImage() ?? $this->rotation->advance($device);
 
@@ -124,6 +135,7 @@ class DeviceImageController extends AbstractController
             // though the device has been confirming the new one for cycles.
             $device->setCurrentImage($image);
             $em->flush();
+            $this->mercure->publishDevice((int) $device->getId(), $this->serializer->serialize($device));
 
             $this->logger->info('device.poll.no_change', [
                 'device_id'   => $device->getId(),
@@ -164,6 +176,10 @@ class DeviceImageController extends AbstractController
         $device->setCurrentRenderedAt($renderedAt);
         $em->flush();
 
+        // Re-publish: currentImageId just changed, so the SPA needs the
+        // updated thumbnail URL. Cheap; the hub deduplicates per topic.
+        $this->mercure->publishDevice((int) $device->getId(), $this->serializer->serialize($device));
+
         $this->logger->info('device.poll.served', [
             'device_id'   => $device->getId(),
             'mac'         => $mac,