chore(mcp): adopt the 2026-07-28 stateless core and cacheable discovery

## Summary\n\nUpgrade the production WorldMonitor MCP endpoint from its current 2025-06-18 handshake/session transport to a dual-version implementation that supports MCP 2026-07-28's stateless core while preserving legacy clients during Claude's rollout.\n\nThis is the prerequisite for later MRTR, Tasks, and hardened extension work.\n\nPrimary references:\n- https://claude.com/blog/bringing-mcp-2026-07-28-to-claude\n- https://blog.modelcontextprotocol.io/posts/2026-07-28/\n- https://modelcontextprotocol.io/specification/2026-07-28\n\n## Current state\n\nThe server card advertises 2025-06-18. The live handler currently:\n- negotiates through initialize / notifications/initialized;\n- mints and returns Mcp-Session-Id;\n- supports Last-Event-ID SSE replay;\n- declares Apps and Logging capabilities in the initialize result;\n- does not implement server/discover, Mcp-Method / Mcp-Name routing, 2026 resultType envelopes, or list cache hints.\n\nRelevant surfaces:\n- api/mcp.ts\n- api/mcp/handler.ts\n- api/mcp/constants.ts\n- api/mcp/types.ts\n- api/mcp/resources/\n- api/mcp/prompts/\n- public/.well-known/mcp/server-card.json\n- tests/mcp-protocol-version.test.mjs\n- tests/mcp-transport-conformance.test.mjs\n\n## Scope\n\n### Stateless 2026-07-28 compatibility\n\n- Add 2026-07-28 to the supported-version matrix behind a rollback-safe rollout switch.\n- For 2026 requests, accept self-contained client identity, capabilities, and protocol metadata on every request.\n- Implement server/discover with server identity, supported versions, capabilities, and supported extensions.\n- Require and validate Mcp-Method and Mcp-Name for new-version Streamable HTTP requests.\n- Include server identity and the required resultType contract in new-version results.\n- Do not require initialize, notifications/initialized, Mcp-Session-Id, Last-Event-ID, or transport-hidden session state for the new path.\n- Preserve the existing 2025-03-26 / 2025-06-18 behavior until measured client compatibility permits retirement.\n\n### Cacheable discovery and resources\n\n- Add spec-correct ttlMs and cacheScope metadata to tools/list, prompts/list, resources/list, resources/templates/list, and resources/read.\n- Keep tool, prompt, and resource ordering deterministic.\n- Use private scope for authenticated, entitlement-sensitive, or user-specific responses; public only for genuinely shared anonymous content.\n- Verify quota and auth semantics remain identical when a client serves a cached catalog.\n\n### Routing, tracing, and deprecated features\n\n- Use Mcp-Method / Mcp-Name for route-aware auth, rate limiting, metrics, and edge/WAF observability without trusting headers over the JSON-RPC body.\n- Propagate W3C traceparent, tracestate, and baggage through the new MCP metadata convention and correlate them with the existing usage telemetry.\n- Do not advertise deprecated Logging on the 2026 path; retain compatibility only for older versions.\n- Replace any new-version catalog-change transport with subscriptions/listen rather than the retired GET/SSE mechanism.\n- Capability-gate existing io.modelcontextprotocol/ui Apps metadata under the new extensions framework while retaining normal structured/text fallbacks.\n\n## Acceptance criteria\n\n- [ ] 2026-07-28 requests work without initialize or a session header and can land on different stateless instances.\n- [ ] server/discover returns the authoritative version/capability/extension contract.\n- [ ] Mcp-Method and Mcp-Name mismatches fail closed with covered protocol errors.\n- [ ] Every successful new-version result carries the required resultType and server metadata.\n- [ ] List/resource methods carry tested ttlMs and cacheScope values and deterministic ordering.\n- [ ] Existing Apps render only when negotiated; non-App clients retain structured/text results.\n- [ ] Existing 2025-03-26 and 2025-06-18 conformance tests remain green.\n- [ ] New wire-level tests cover disconnect retry semantics without SSE replay.\n- [ ] Server card, docs, error catalog, CORS headers, and agent discovery metadata match the live contract.\n- [ ] Focused MCP suites plus npm run typecheck:api pass sequentially.\n\n## Non-goals\n\n- Implementing Tasks or MRTR business workflows.\n- Removing legacy protocol support in the same change.\n- Adding mutating tools.\n\n## Rollout\n\nShip dual-stack first, measure client versions/errors/latency, and retain a kill switch. Claude support is rolling out rather than universally available, so 2026-only behavior must not become a hard dependency yet.

Start with api/mcp.ts, api/mcp/handler.ts, api/mcp/constants.ts, and api/mcp/types.ts, then read the existing protocol-version and transport-conformance tests. Trace the listed resource and prompt surfaces, server card, and metadata before defining the dual-version behavior. Done means the stated acceptance criteria pass, including focused MCP suites and npm run typecheck:api.

Written by the indexing model from the issue text.