Fix Streamable HTTP handling for MCP clients

[kmckiern]

Summary

Newer versions of mcp-remote (and Claude Desktop) follow the 2025-03-26 MCP transport spec by starting the session with a GET /mcp request that sets Accept: text/event-stream before issuing the POST. Our server still responded with the README for GET, so the client received text/plain instead of text/event-stream and aborted. Without a valid session it then fell back to an OAuth-style /register flow, resulting in 404s.

This PR routes GET/POST/DELETE /mcp through shared logic that:

• Authenticates via x-api-key or bearer tokens.
• Creates sessions only when allowed and returns spec-compliant errors for missing or unknown session IDs.
• Serves SSE responses when requested and only falls back to the README for non-SSE GETs.
• Reuses transports and always returns the active Mcp-Session-Id header so clients stay in sync.

Testing

• npm run build
• npm test -- --watchman=false