Clean up MCP sessions on delete

[lucarlig]

Splits MCP session DELETE cleanup out of the larger session/SSE work so this PR stays focused.

This PR:

• replaces the custom tower-layer session-id layer with Axum middleware state so DELETE can run cleanup after RMCP handles the request
• keeps Mcp-session-id optional; requests without the header pass through, including DELETE
• inserts SessionId extensions when the header is present, then uses match request.method() to run DELETE cleanup only after a successful downstream response
• scopes stored user sessions by authenticated principal plus downstream MCP session id
• scopes backend transport keys and cleanup by authenticated principal plus downstream MCP session id, so one user cannot clean up another user
• removes the session-store entry and in-memory backend transports after RMCP accepts DELETE
• removes the now-unused tower-layer dependency

Verification:

• cargo fmt --all --check
• cargo clippy --locked --workspace --all-targets -- -D warnings
• cargo test --locked --workspace
• CI: fmt, clippy, cargo-deny, cargo-shear, test, build, bench