[BUG] ShenyuStreamableHttpServerTransportProvider.createSessionAndRestoreId leaks sessions

- severity: High
- files: `shenyu-plugin/shenyu-plugin-mcp-server/src/main/java/org/apache/shenyu/plugin/mcp/server/transport/ShenyuStreamableHttpServerTransportProvider.java:461-490`
- description: When a client sends a request with a `sessionId` that does not exist (server restart, timeout, stale client), `createSessionAndRestoreId` creates a new `McpServerSession`+`StreamableHttpSessionTransport`, stores them in `sessions`/`sessionTransports`, and processes one request — but, unlike `createTemporarySessionAndProcess` (which has a `.doFinally(...removeSession...)`), the restore path has no cleanup hook. The session and transport remain in both maps forever.
- impact: Unbounded memory growth of `sessions`/`sessionTransports`/`ShenyuMcpExchangeHolder` via the stale-session restore path.
- suggested_fix: Add a `doFinally` to `createSessionAndRestoreId` that calls `removeSession(actualSessionId)` and `ShenyuMcpExchangeHolder.remove(actualSessionId)`.
- confidence: High
- related_existing: none — #6473/#6117 are different defects.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._