* Sync German docs with #13917

Plus a typo fix in tutorial/security/oauth2-jwt.md line 89.

* Sync german docs with #14099

---------

Co-authored-by: Motov Yurii <109919500+YuriiMotov@users.noreply.github.com>

## Summary

- **Bug:** The four SSE route handlers open a dedicated asyncpg
connection via `open_listen_for_*` BEFORE constructing
`EventSourceResponse` (preserves #376 — preflight failures must surface
as 503 before 200 OK). The wrapped generator owns
`subscription.terminate()` in `finally`. But if the request task is
cancelled in FastAPI's dispatch gap — between `response = await
handler(request)` and the subsequent `await response(scope, receive,
send)` — the async generator is **never started**, and Python's
async-generator semantics guarantee that an unstarted generator's
`finally` block does NOT execute on `aclose` or GC. The asyncpg
connection, its `LISTEN`, and the SSE subscriber advisory lock leak
until TCP keepalive reaps the backend (~2h). Server restart with N
concurrent in-flight SSE setups leaks up to N postgres backends.
- **Reachability:** narrow (server shutdown / fast client disconnect
striking the µs-scale dispatch window) but real and persistent.
- **Fix:** `make_sse_response(subscription, content, *, ping=15)` in
`api/sse.py` constructs the `EventSourceResponse` and registers
`weakref.finalize(response, subscription.terminate)`. The finalizer
fires on response GC — including the un-invoked path. Migrated the 4 SSE
route sites to use the helper.
- **Idempotency:** `terminate()` is synchronous (see `db/listen.py`
docstring) and idempotent at asyncpg's transport layer, so the duplicate
call in the normal path (generator `finally` + finalizer) is a no-op.
- **Design alternative considered:** FastAPI `Depends`-with-yield (one
mechanism via `AsyncExitStack`). Rejected after code review: (a)
`Depends` teardown's cancellation guarantee only stabilized in
[fastapi#14099](fastapi/fastapi#14099) (Sep
2024), vs `weakref.finalize`'s stdlib-since-3.4 stability; (b) the
refactor would scatter `SSE_PREFLIGHT_EXCEPTIONS` handling and
per-stream `detail` payloads across 4 dependency functions; (c) the two
cleanup hooks here operate on **disjoint object-graph states**
(started-then-disconnect vs never-started), not duplicating a single
guard.

## Test plan

- [x] mypy — clean (160 source files)
- [x] ruff check + format — clean
- [x] Unit suite — 1470 passed (new
`test_make_sse_response_terminates_subscription_when_response_uninvoked`
is red without the finalize, green with — confirmed)
- [x] Code-reviewer independently re-verified discriminating power
(removed `weakref.finalize`, observed test failure on the right
assertion) plus `Depends(yield)` cancellation behavior
- [ ] CI runs e2e/integration suite

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>