New HTTP serving path (modern + dual-era)

[maxisbey]

Tracks: #2803

A single HTTP entry that branches: legacy traffic goes to the existing manager untouched; modern traffic goes to a new sessionless path. This is where the sessionless wire mode and the inbound header validation live.

What's in it

• Single entry point that branches legacy → existing StreamableHTTPSessionManager (untouched, including stateless_http=True), modern → a new direct path.
• Sessionless wire mode for modern traffic: no session-id minting, GET/DELETE → 405, disconnect = cancel.
• The inbound validation ladder lives here (header↔body cross-check, error → HTTP status mapping).
• Where the subscriptions/listen long-lived stream plugs in.
• What stateless_http=True means going forward (current behaviour kept; era is a separate axis).

Conformance

• http-header-validation
• http-custom-header-server-validation (with the helpers from HTTP standard headers + x-mcp-header #2900)
• Together with Backwards compatibility & version negotiation, Capabilities API + server/discover handler, subscriptions/listen, Context object (layered, per-request): server-stateless
• Once the upstream server-sessionless scenario lands in the conformance suite and the conformance version pinned in CI is bumped: server-sessionless

Dependencies

• Depends on: Backwards compatibility & version negotiation #2892

References

• Streamable HTTP
• SEP-2567
• SEP-2243
• server/stateless.ts

[maxisbey]

Shipped in v2.0.0b1: the branching entry (legacy manager untouched), sessionless wire mode, the full inbound validation ladder including server-side header/body cross-checks (#3033), and the listen stream plug-in (#3035). http-header-validation, http-custom-header-server-validation, and server-stateless all pass. The one remaining line — the server-sessionless scenario — is waiting on that scenario landing upstream in the conformance suite, not on SDK work.

_{AI Disclaimer}