mcp: add StreamableHTTPOptions.StreamKeepAlive for periodic SSE comments on idle streams - #1232

The 2026-07-28 Streamable HTTP spec encourages servers to periodically emit an SSE comment line on long-lived streams, in particular the subscriptions/listen response, so that idle-timeout intermediaries do not sever them. The SDK had no way to do this: the stream's ResponseWriter is private and every write goes through deliverLocked under stream.mu. Servers behind a proxy ended up sending fake notifications/resources/updated as a heartbeat instead.

This adds StreamableHTTPOptions.StreamKeepAlive time.Duration. The response stream of a subscriptions/listen request gets a goroutine that writes the bare :\n\n comment from the spec example and flushes whenever the stream has carried no bytes for that duration. Zero selects DefaultStreamKeepAlive (30s), so servers follow the spec out of the box; a negative value disables the keep-alive. This is the same convention as MaxRequestBodyBytes. Other SSE responses are not kept alive; the standalone GET stream and EventStore paths are untouched.

Semantics:

• Idle-reset per stream. stream.lastWrite is stamped by every write in deliverLocked; the goroutine sleeps until lastWrite + interval, so a busy stream gets no comments and a quiet one gets exactly one per interval.
• Nothing is written before the listen acknowledgment. deliverLocked may still need to set a 400/404 status for a SEP-2575 error, which requires uncommitted headers, so the goroutine parks on a committed channel that the first write closes. The acknowledgment arrives within milliseconds, so this costs nothing.
• Writes happen under stream.mu, so a comment can never interleave with an event.
• A failed write closes the stream's done channel: hangResponse returns, the request context is cancelled, and the listen handler unwinds and unsubscribes. A dead peer is therefore noticed within one interval rather than at the next real notification.
• X-Accel-Buffering: no is set on SSE POST responses, which the same spec section recommends; the header is dropped again on the JSON error-override path.

Tests: a raw listen POST sees the ack and then only comments; a slow tools/call gets no comment at all; the option resolution (zero, negative, explicit, nil options) is checked; the goroutine semantics (park, idle-reset, failed write closes the stream) are tested directly; keep-alive goroutines end with their streams; and an end-to-end test puts an idle-timeout proxy in front of the server and checks that a quiet subscription dies with the keep-alive disabled and survives with it, with the SDK client ignoring the comments.

Fixes #1229