ds4-server: SSE keepalive during decode

[Allen091080]

Summary

Small follow-up to f91c12b (prefill keepalive via prefill_display).

The prefill side is now well-covered. Decode can still go quiet for tens of seconds when:

• the model is mid-thinking — <think>...</think> is open and no visible text has been flushed;
• the model is accumulating a large tool_use input JSON, which is held back until the block closes.

sse_chunk only fires when there is actual streamable text, so the socket sees nothing during those stretches. Past the client's TCP idle threshold (10-60 s on most HTTP libraries), the next sse_chunk call records client stream write failed and the turn errors out — same failure shape that prompted issue #222 on the prefill side, just on the other end of the turn.

Fix

In the decode loop, when j->req.stream is set, emit a : decode\n\n SSE comment line at most every 15 s:

if (j->req.stream) {
    double now_kp = now_sec();
    if (now_kp - decode_last_keepalive >= 15.0) {
        static const char ka[] = ": decode\n\n";
        if (!send_all(j->fd, ka, sizeof(ka) - 1)) {
            finish = "error";
            snprintf(err, sizeof(err),
                     "client stream write failed during decode heartbeat");
            break;
        }
        decode_last_keepalive = now_kp;
    }
}

15 s mirrors the prefill cadence and sits inside common 30-60 s client idle thresholds. Failed write ends the turn via the existing client stream write failed path — no new failure mode for callers.

Scope (intentionally minimal)

• No watchdog thread.
• No _exit.
• No struct fields added.
• Only one new local variable (decode_last_keepalive).
• Does not cover GPU/Metal kernel hangs inside ds4_session_* — out of scope.

Verification

Machine: MacBook Pro M5 Max, 128 GiB RAM
Backend: Metal
Model: DeepSeek-V4-Flash-IQ2XXS-w2Q2K-AProjQ8-SExpQ8-OutQ8-chat-v2.gguf (q2-imatrix)
Server: ./ds4-server --host 0.0.0.0 --port 8000 --ctx 500000 --kv-disk-dir … --kv-disk-space-mb 204800

• make clean, no new warnings.
• ./ds4_test --server passes (server: OK / ds4 tests: ok).
• Streamed completions where the model thinks for 30+ s now show : decode comment lines on the wire every 15 s, no client disconnect.

Test plan

• CI runs ./ds4_test --server
• Manual: chat request that forces a long <think> phase or large tool_use input; observe : decode comment lines on the SSE wire and no client stream write failed errors at the end.