Add idle session timeout to StreamableHTTPSessionManager

[felixweinberger]

Port of #1994 (v1.x) to main.

Motivation and Context

Sessions created via StreamableHTTPSessionManager persist indefinitely in _server_instances even after the client disconnects, leaking memory over time (issue #1283).

The session_idle_timeout parameter automatically terminates and removes sessions that receive no HTTP requests for the configured duration. Each session manages its own lifetime via an anyio CancelScope deadline — no background reaper task needed. Incoming requests push the deadline forward to keep active sessions alive.

How Has This Been Tested?

Tests added to tests/server/test_streamable_http_manager.py: idle session reaping (deterministic, no sleeps), terminate idempotency, and parameterized input validation. All existing tests pass unchanged.

Breaking Changes

None — new optional parameter with default None.

Types of changes

• New feature (non-breaking change which adds functionality)

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed