fix(mcp): emit a single Mcp-Session-Id header and relay DELETE results in the identity proxy

[maxlamagna]

The identity proxy's _send_response_headers listed both Mcp-Session-Id and mcp-session-id. Python's response-header lookup is case-insensitive, so both lookups returned the same session ID and the proxy emitted it twice. Strict streamable HTTP clients, including Claude Code 2.1.216 and 2.1.217, combine those duplicate values into S, S, then echo the invalid ID on the next request. The server returns 404 Session not found during the initialize to notifications/initialized handshake, so native MCP tools never attach. Older clients tolerated the duplicate, which hid the defect.

do_DELETE also collapsed every upstream HTTP error into a generic 502. It now relays the upstream HTTP status, body, and session header. Only network-level URLError and OSError failures become 502.

tests/test_mcp_proxy.py adds five regression tests covering a single case-insensitive session header, follow-up POST session preservation, DELETE success and HTTP-error relay, and an SDK-style initialize to notifications/initialized to tools/list lifecycle through the proxy.

Live verification: Claude Code 2.1.217 attached native MCP tools and completed chat_read and chat_send through the patched proxy.

Full suite: 80 tests ran; 78 passed, 1 Windows-only test was skipped on macOS, and 1 unrelated test failed. test_stale_token_is_rejected_after_deregister fails identically on upstream main at 51660a1 without this patch and passes at 372196e, immediately before #75. This PR does not modify that behavior.

Fixes #80