MCP Streamable HTTP endpoint.

Authentication is enforced by the :api pipeline before this controller runs. Trace context is extracted from the traceparent header and passed to store operations that accept it; a missing or malformed header starts a new trace without changing auth, results, or response shapes.