refactor: simplify and harden framework-mounted MCP routes

[quuu]

Summary

• describe mcp-handler as a framework-agnostic Web Request/Response adapter
• mount one static Streamable HTTP route instead of generating a dynamic transport route
• remove internal endpoint derivation and legacy SSE/message response handling
• keep removed 1.x config keys as ignored 2.x type compatibility shims
• preserve explicit auth handoff without request-global async context
• reject unexpected browser Origins and support an explicit allowedOriginHostnames list
• preserve Allow: POST on stateless 405 responses and isolate sync/async event-hook failures
• make the CLI support src/app, --no-install, and safe refusal to overwrite existing routes
• fix the CommonJS type declaration export and ship documentation linked from the npm README

Validation

• pnpm test: 44 tests across 6 files
• SDK 1.26 client connect, discovery, and tool call
• SDK 2 client in legacy and pinned 2026-07-28 modes
• concurrent auth isolation plus required, scope, expiry, and verifier failure paths
• raw HTTP media type, malformed JSON, Origin, method, route, and event failure boundaries
• generated CLI route and packed CJS/ESM artifact smoke tests
• pnpm build
• pnpm exec tsc --noEmit --noUnusedLocals --noUnusedParameters
• git diff --check
• linked package in the mcp-for-next.js template: production build and type check pass
• MCP Inspector CLI: tools/list, valid and invalid tools/call, and a dynamic custom mount path pass

Release

Includes a patch changeset for mcp-handler.