New HTTP serving path (modern + dual-era)

[maxisbey]

Tracks: #2803

A single HTTP entry that branches: legacy traffic goes to the existing manager untouched; modern traffic goes to a new sessionless path. This is where the sessionless wire mode and the inbound header validation live.

What's in it

• Single entry point that branches legacy → existing StreamableHTTPSessionManager (untouched, including stateless_http=True), modern → a new direct path.
• Sessionless wire mode for modern traffic: no session-id minting, GET/DELETE → 405, disconnect = cancel.
• The inbound validation ladder lives here (header↔body cross-check, error → HTTP status mapping).
• Where the subscriptions/listen long-lived stream plugs in.
• What stateless_http=True means going forward (current behaviour kept; era is a separate axis).

Conformance

• http-header-validation
• http-custom-header-server-validation (with the helpers from HTTP standard headers + x-mcp-header #2900)
• Together with Backwards compatibility & version negotiation, Capabilities API + server/discover handler, subscriptions/listen, Context object (layered, per-request): server-stateless
• Once the upstream server-sessionless scenario lands in the conformance suite and the conformance version pinned in CI is bumped: server-sessionless

Dependencies

• Depends on: Backwards compatibility & version negotiation #2892

References

• Streamable HTTP
• SEP-2567
• SEP-2243
• server/stateless.ts