feat(mcp-gateway): session-aware fast path — upstream pooling, circuit breaker, adaptive timeouts

## Summary

Harden the gateway data path for MCP streaming traffic: tuned upstream connection pooling, per-upstream circuit breaking, and timeout classes that distinguish streaming (SSE) from unary tool calls.

## Motivation

The gateway currently uses `httputil.ReverseProxy` over `http.DefaultTransport` with no upstream timeout, no connection-pool tuning, and no circuit breaker (`services/mcp-gateway/main.go`). For long-lived SSE sessions plus bursty tool calls this means head-of-line blocking on a slow upstream and no fast-fail when the MCP server is down. Related: #302 (upstream timeout).

## Scope

- **Upstream transport tuning** (`main.go`): dedicated `http.Transport` for the proxy with `MaxIdleConnsPerHost`, keepalive, and TLS handshake timeouts sized for sidecar-local upstreams
- **Timeout classes**: per-request deadline for unary JSON-RPC calls; no read deadline for SSE/streaming responses (detect via Accept/Content-Type)
- **Circuit breaker**: consecutive upstream failures (502/connect errors) open the breaker; gateway fast-fails with 503 + `upstream_unavailable` reason (audited) instead of stacking doomed requests; half-open probe to recover
- **Backpressure**: cap in-flight upstream requests; reject excess with 429 rather than queueing unboundedly

## Acceptance criteria
- [ ] Unary tool calls have a bounded upstream deadline; SSE streams are not killed by it
- [ ] Breaker opens after N consecutive upstream failures, recovers via half-open probe
- [ ] Denials due to breaker/backpressure appear in audit events with distinct reasons
- [ ] Load test demonstrating no head-of-line blocking between streaming and unary traffic

🤖 Generated with [Claude Code](https://claude.com/claude-code)