fix: create fresh transport+server per stateless request (CVE-2026-25536)

Summary

• Creates a fresh StreamableHTTPServerTransport and McpServer per POST request in stateless mode, instead of reusing a singleton pair across all requests.
• Widens the @modelcontextprotocol/sdk peer dependency from the pinned 1.25.2 to >=1.25.2 so consumers can use patched SDK versions.

Problem

@modelcontextprotocol/sdk >=1.26.0 added runtime guards to fix CVE-2026-25536, a High severity cross-client data leak where JSON-RPC message ID collisions cause responses to be routed to the wrong client's HTTP connection.

The guard enforces that a stateless StreamableHTTPServerTransport cannot be reused across requests:

Stateless transport cannot be reused across requests.
Create a new transport per request.

mcp-handler creates a single transport and server at module init time and reuses them for every POST request, which triggers this guard on SDK >=1.26.0 and returns a 500 to all requests after the first.

Fix

Moves the StreamableHTTPServerTransport and McpServer creation from module-level singletons into the POST handler, so a fresh instance of each is created per request. This matches the workaround recommended in the CVE advisory.

Test plan

• Existing e2e tests pass (the one failing test in should read server capabilities is a pre-existing issue on main due to new SDK fields in the tool schema)
• Verified with a real consumer project that was hitting the 500 after yarn dedupe unified the SDK to 1.27.0