Close SSE transports on timeout/error and evict sessions with failed SSE writes

[ikaitist]

Fixes #6860

What

WebMvcStreamableServerTransportProvider leaks SSE sockets when clients disconnect without DELETE. Two gaps fixed:

• sseBuilder.onTimeout only logged; onError was not handled at all. Both now close the session transport, freeing the socket immediately.
• notifyClients logged send failures and kept dead sessions. A failed SSE write now evicts the session (removeSession + closeGracefully).

Session slots for silent clients remain covered by the existing idle eviction (sessionIdleTimeout).

How verified

• Syntax-checked locally; module tests run in CI (local reactor build is blocked by milestone repository access from the contributor network).

[sobychacko]

Thanks for this, @ikaitist. This overlaps heavily with #6871, which targets the same issue (#6860) and takes a broader pass at the same fix: it unifies the onComplete, onTimeout, and onError callbacks through a single idempotent close() and also covers the request-response streaming and replay error paths, plus it adds unit tests. One notable difference is session handling on an SSE write failure. This PR evicts the logical session via removeSession and closeGracefully, whereas #6871 intentionally closes only the current transport so that the same mcp-session-id and Last-Event-ID replay keep working on subsequent requests, deferring eviction to DELETE or keep-alive. Given that overlap we plan to proceed with #6871 and close this one. We really appreciate you digging into the socket leak, and we would welcome your review on #6871 and any future contributions.