Add read and subscribe operations to the Pelican API

[rbardaji]

Context

The Pelican integration currently exposes four operations in api/routes/pelican_routes.py:

Operation	Route
list / ls	GET /pelican/browse (plus GET /pelican/info for a single object)
download / wget	GET /pelican/download
import into the catalog	POST /pelican/import-metadata

Two operations have no equivalent in the API:

1. read — return the contents of an object (a file, an origin, or the object referenced by an event) in the response body, instead of streaming it to disk as /download does. This is the operation a caller needs in order to feed the contents straight into their own code without a temporary file.
2. subscribe — subscribe to the events of a namespace.

That both already work in the ndp-ep client library is taken from the demo shown on the call; the library is not a dependency of this repository and was not checked here. Confirm against the library before implementing, since it determines how much of this is wiring versus new work.

upload is explicitly out of scope for now.

Design question for subscribe

subscribe is a long-lived stream, which does not map onto a plain request/response route. Three options, to be decided before implementation:

• Server-Sent Events — GET /pelican/subscribe returning a text/event-stream. Simplest to implement on top of the existing async stack and easy to consume from both Python and the browser, but holds a worker connection open per subscriber.
• Webhook — the caller registers a callback URL and the endpoint POSTs each event to it. Scales better and survives client restarts, but requires the caller to be reachable, plus storage and lifecycle management for the registrations.
• Polling with a cursor — the endpoint buffers events and the caller polls for those newer than a cursor. No long-lived connections, but adds latency and a buffer that needs bounding.

Acceptance

• Both operations behind the same authorization used by the rest of the Pelican routes (see Pelican federation routes are exposed without authentication #261).
• Tests covering the success path and the error paths, matching the existing tests/test_pelican_routes.py style.
• CHANGELOG.md entry and any new setting added to example.env.

[rbardaji]

Decision on the subscribe transport: Server-Sent Events.

GET /pelican/subscribe returns a text/event-stream, one event per message. Chosen over webhooks and cursor polling because it needs no stored subscription state and no reachable caller, it consumes identically from Python and from a browser, and it is the option that demonstrates cleanly in the notebook. The known cost is one held connection per subscriber, which is acceptable at the scale we expect and can be revisited if it becomes a limit.

Splitting the work: read does not depend on this decision and goes first, in its own branch. subscribe follows on top of it and closes this issue.