fix: harden SSE compression exclusion and add Caddy reverse proxy docs (#939)

The compression middleware filter runs before route handlers, so the
res.getHeader('Content-Type') check in shouldSkipCompression is always
undefined at decision time. SSE exclusion relied entirely on the Accept
header, which non-standard clients (curl, fetch) may omit.

Add deterministic path-based exclusion for all known SSE routes so
compression is skipped regardless of client behavior. Also add a Caddy
reverse proxy example and a CDN double-compression warning to docs.

packages/web/server/index.js

@@ -109,11 +109,37 @@ function headerIncludesEventStream(value) {
   return false;
 }
 
+/**
+ * SSE endpoint paths that must never be compressed by the compression middleware.
+ *
+ * The compression middleware filter runs before route handlers, so
+ * `res.getHeader('Content-Type')` is still undefined at that point.
+ * This means the Accept-header check alone is not sufficient for
+ * non-standard clients (e.g. curl, fetch) that omit Accept.
+ * Path-based exclusion acts as a deterministic fallback.
+ */
+const SSE_PATH_PREFIXES = [
+  '/api/event',
+  '/api/global/event',
+  '/api/notifications/stream',
+  '/api/openchamber/events',
+];
+
 function shouldSkipCompression(req, res) {
   if (headerIncludesEventStream(req.headers.accept)) {
     return true;
   }
 
+  const pathname = req.path || req.url || '';
+  if (pathname.startsWith('/api/terminal/') && pathname.endsWith('/stream')) {
+    return true;
+  }
+  for (const prefix of SSE_PATH_PREFIXES) {
+    if (pathname === prefix) {
+      return true;
+    }
+  }
+
   return headerIncludesEventStream(res.getHeader('Content-Type'));
 }