fix: buffer complete secret watch events

[Shubham-Padkonde]

Fixes #536.

The watch reader currently passes each network read directly to the event parser. A read can contain part of an event or several events, so valid server responses can produce parse errors and missed updates.

Buffer lines until the blank line ending each SSE frame, normalize CRLF to LF for the existing parser, and dispatch each complete frame separately. An incomplete final frame is discarded; the connection error still propagates to the existing reconnect logic. Callback dispatch remains asynchronous.

Validation: all package tests pass (go test ./pkg/...), and the HTTP package passes with the race detector. Four local HTTP regressions fail before this change and pass afterward: combined events, an event larger than the old 1024-byte buffer, CRLF frames, and a truncated final event. Formatting and git diff --check pass. The authenticated end-to-end suite was not run.