fix(server): deregister terminated streamable HTTP sessions

[mikemikimike]

Summary

• remove terminated existing sessions from both session registries immediately after handling the request
• add a regression test for the clean DELETE/session termination path

Fixes #3300

Scope

• The fix is for the handshake-era streamable HTTP path. Released mcp 1.29.0 has no modern request handler, so clients negotiating a newer protocol version still use the affected handshake path there.
• This is not mitigated through the public server APIs: session_idle_timeout is not accepted by streamable_http_app() or MCPServer, and FastMCP does not expose it either. Deployments using those APIs cannot configure the idle reaper without reaching into lower-level internals.

Validation

• uv run --frozen ruff format ...
• uv run --frozen ruff check src/mcp/server/streamable_http_manager.py tests/server/test_streamable_http_manager.py
• uv run --frozen pyright src/mcp/server/streamable_http_manager.py tests/server/test_streamable_http_manager.py
• uv run --frozen pytest tests/server/test_streamable_http_manager.py -q (31 passed)
• git diff --check

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 1 file (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[github-actions]

Thanks for the contribution. This repository only keeps pull requests open when they're linked to an issue that a maintainer has assigned to the author — CONTRIBUTING.md explains why and how we work. This PR has been closed for now because you aren't currently assigned to #3300.

If a maintainer would like this change as a PR from you, they'll assign you to #3300 and this PR will reopen automatically — there's nothing more you need to do. (If you opened the issue, this PR already shows up on its timeline.)

There's no need to open a new PR — this one will be reopened. While it's closed, please push any updates as new commits rather than force-pushing, since GitHub can't reopen a PR whose branch has been rewritten.

Maintainers: reopening this PR, removing the missing-issue-link label, or adding bypass-issue-check bypasses the check.