fix: allow concurrent streamable http requests

[nickcoai]

Summary

Allow ordinary streamable http POSTs to run concurrently. Previously, one slow application/json response blocked unrelated requests.

StreamableHttpClientTransportConfig::max_concurrent_requests defaults to 16. Set it to 1 to keep ordinary POSTs serial; 0 is treated as 1. Open sse response streams do not count against this limit. Initialization and protocol-version changes remain ordered with ordinary POSTs.

Response cleanup matches ids against all pending requests, not just open response streams. Exact ids take precedence over the existing numeric-string fallback.

Cancellation and recovery

Cancellation and replies to server requests use a separate bounded queue with one extra POST slot. Each control POST has a five-second timeout after it starts. Queued and active ordinary POSTs can be cancelled without waiting for a free slot.

For an open legacy response stream, cancellation stops reading but keeps the stream alive until the cancellation send finishes or is dropped. This lets custom http adapters handle cancellation using their existing stream state. Ordinary legacy cancellation notifications still reach the adapter; modern http cancellation remains local.

When recovery is enabled, ordinary POSTs that report SessionExpired in the same session share one recovery attempt. Wait up to session_recovery_timeout for old POSTs, then stop any that remain. Those interrupted POSTs return SessionRecoveryTimeout and are not retried: the server may have processed them. The replacement handshake has a separate timeout of the same length; both default to five seconds.

Retry only ordinary POSTs that returned SessionExpired, at most once each. Control POSTs are not retried. A request that already completed on the common response stream is not retried. Old queued controls cannot change replacement-session state, and a cancelled or dropped version-change request does not block later requests.

The shared worker's control queue is opt-in; server scheduling is unchanged. Callers still decide which tools may run together and which need approval. Oauth refresh coordination remains a separate follow-up.

Validation

Passed locally:

• Client-only concurrency target: 19 tests, including distinct numeric/string response ids, early responses, recovery, cancellation, and custom-adapter compatibility.
• Worker unit tests: 3 tests for abandoned cancellation with a separate registration owner, request-id reuse, and exact cancellation-id matching.
• cargo +1.96 test --offline --all-features
• Selected transport targets with the complete non-local feature set from justfile: 35 tests covering concurrency, subscriptions, expired sessions, disconnects, connection reuse, and shutdown.
• cargo +1.96 clippy --offline --all-targets --all-features -- -D warnings
• cargo +nightly fmt --all -- --check
• git diff --check

Two downstream custom-adapter integration tests also passed without adapter source changes.