fix(streamable-http): Correct session lifecycle

[jstar0]

Summary

• return 400 for non-initialize Streamable HTTP POST requests that omit Mcp-Session-Id
• remove Streamable HTTP sessions from the dev server maps when DELETE closes them
• add raw HTTP coverage for session lifecycle, notification envelope, malformed JSON, and protocol-version handling

Changes

• Split the invalid Streamable HTTP POST branch so missing session IDs and unknown session IDs return the expected status codes.
• Register onsessionclosed for Streamable HTTP transports so DELETE removes the session from the dev server's local maps.
• Add a raw HTTP test that starts the Express app directly and verifies session lifecycle, notification, malformed JSON, and protocol-version behavior without going through the SDK client.

Why

The raw HTTP contract distinguishes a missing session header from an unknown session:

• missing Mcp-Session-Id on non-initialize requests should be a bad request
• unknown or terminated sessions should be not found so clients can recover by initializing a new session

The current dev server kept a closed transport in its local session maps after DELETE, so the same session ID could be reused after termination.

Verification

pnpm exec vitest run tests/unit/dev_server.streamable_http.test.ts
pnpm run type-check
pnpm run lint
pnpm run test:unit
pnpm run format
pnpm run format:check
pnpm run check:agents

Fixes #918