security: add maximum session limit to prevent memory exhaustion

Add configurable MaxSessions limit (default: 10000) to SessionStore.
When the limit is reached, new session creation returns ErrTooManySessions
and HTTP transport responds with 503 Service Unavailable.

This prevents attackers from exhausting server memory by creating
unlimited sessions through repeated initialize requests.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/mcp/transport_http.go

@@ -17,6 +17,7 @@ type HTTPConfig struct {
 	Endpoint          string        // MCP endpoint path (e.g., "/mcp")
 	AllowedOrigins    []string      // Allowed Origin headers for CORS (empty = localhost only)
 	SessionTTL        time.Duration // Session TTL (default: 30 minutes)
+	MaxSessions       int           // Maximum concurrent sessions (default: 10000)
 	TLSCertFile       string        // TLS certificate file (optional)
 	TLSKeyFile        string        // TLS key file (optional)
 	MaxRequestSize    int64         // Maximum request body size in bytes (default: 1MB)
@@ -55,6 +56,9 @@ func NewHTTPTransport(server *Server, config HTTPConfig) *HTTPTransport {
 	if config.SessionTTL == 0 {
 		config.SessionTTL = 30 * time.Minute
 	}
+	if config.MaxSessions == 0 {
+		config.MaxSessions = DefaultMaxSessions
+	}
 	if config.MaxRequestSize == 0 {
 		config.MaxRequestSize = DefaultMaxRequestSize
 	}
@@ -74,7 +78,7 @@ func NewHTTPTransport(server *Server, config HTTPConfig) *HTTPTransport {
 	return &HTTPTransport{
 		server:   server,
 		config:   config,
-		sessions: NewSessionStore(config.SessionTTL),
+		sessions: NewSessionStoreWithLimit(config.SessionTTL, config.MaxSessions),
 	}
 }
 
@@ -231,6 +235,11 @@ func (t *HTTPTransport) handleInitialize(w http.ResponseWriter, r *http.Request,
 	// Create a new session
 	session, err := t.sessions.Create()
 	if err != nil {
+		if err == ErrTooManySessions {
+			t.server.logger.Printf("Session limit reached")
+			http.Error(w, "Service unavailable: too many active sessions", http.StatusServiceUnavailable)
+			return
+		}
 		t.server.logger.Printf("Failed to create session: %v", err)
 		http.Error(w, "Failed to create session", http.StatusInternalServerError)
 		return