feat(explorer): mission-control resilience, ops token labels, and CI validate

Add SSE reconnect with backoff, fallback REST polling, visibility-aware refresh,
extended token-list labels on operations pages, validate-on-pr workflow, and smoke coverage.

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/src/services/api/missionControl.ts

@@ -280,27 +280,50 @@ export const missionControlApi = {
       return () => {}
     }
 
-    const eventSource = new window.EventSource(getMissionControlStreamUrl())
+    let closed = false
+    let eventSource: EventSource | null = null
+    let reconnectTimer: ReturnType<typeof setTimeout> | null = null
+    let retryMs = 5_000
+    const maxRetryMs = 60_000
 
     const handleMessage = (event: MessageEvent<string>) => {
       try {
         const payload = JSON.parse(event.data) as MissionControlBridgeStatusResponse
+        retryMs = 5_000
         onStatus(payload)
       } catch (error) {
         onError?.(error)
       }
     }
 
-    eventSource.addEventListener('mission-control', handleMessage)
-    eventSource.onmessage = handleMessage
+    const connect = () => {
+      if (closed) return
 
-    eventSource.onerror = () => {
-      onError?.(new Error('Mission-control live stream connection lost'))
+      eventSource?.close()
+      eventSource = new window.EventSource(getMissionControlStreamUrl())
+      eventSource.addEventListener('mission-control', handleMessage)
+      eventSource.onmessage = handleMessage
+      eventSource.onerror = () => {
+        eventSource?.close()
+        eventSource = null
+        onError?.(new Error('Mission-control live stream connection lost'))
+        if (closed) return
+        if (reconnectTimer) clearTimeout(reconnectTimer)
+        reconnectTimer = setTimeout(() => {
+          reconnectTimer = null
+          connect()
+        }, retryMs)
+        retryMs = Math.min(retryMs * 2, maxRetryMs)
+      }
     }
 
+    connect()
+
     return () => {
-      eventSource.removeEventListener('mission-control', handleMessage)
-      eventSource.close()
+      closed = true
+      if (reconnectTimer) clearTimeout(reconnectTimer)
+      eventSource?.removeEventListener('mission-control', handleMessage)
+      eventSource?.close()
     }
   },
 }