fix: resolve OOM from unbounded session dict and fastmcp memory leak (#85)

* fix: resolve OOM from unbounded session dict and fastmcp memory leak

- Upgrade fastmcp 2.14.1 → 2.14.4 (fixes in-memory broker leak, jlowin/fastmcp#2639)
- Upgrade mcp 1.24.0 → 1.26.0
- Pass stateless_http=True to .http_app() for OAuth and header endpoints
  (tools are stateless CRUD — no server-push needed — so stateful sessions
  leak memory since disconnected clients are never evicted from
  StreamableHTTPSessionManager._server_instances)
- SSE transport left unchanged (does not support stateless_http flag)

* test: add stateless HTTP mode tests for OAuth and header endpoints

Verifies that http_app(stateless_http=True) works correctly for both
OAuth and header-auth MCP apps — endpoints respond with expected status
codes and OAuth client registration still functions.