fix(sse): close GET /mcp streams when the opening token expires

[mcollina]

Problem

With authorization enabled, the bearer token is only checked when the legacy SSE GET /mcp stream opens. After that the stream keeps delivering notifications even once the token has expired.

Fix

• If the validated token payload (request.tokenPayload) has an exp, the stream is ended at exp by an unref'd timer, which is cleared when the stream closes. The client reconnects with a fresh token and resumes with Last-Event-ID.
• The configurable maximum lifetime already exists as sseMaxConnectionMs (SEP-1699), so no new option is added. The stream now closes at min(exp, sseMaxConnectionMs).
• setTimeout fires immediately on delays above 2^31-1 ms (~24.8 days), so long deadlines are waited out in capped steps that reschedule until the deadline.
• README and the sseMaxConnectionMs JSDoc describe the behaviour.

subscriptions/listen streams (#170) are not covered here.

Tests

test/sse-token-expiry.test.ts:

• a stream opened with a JWT whose exp is about 2s away closes within 1s after exp, even with a longer sseMaxConnectionMs
• opening a stream adds no ref'd timers (checked with process.getActiveResourcesInfo(); this test fails if .unref() is removed)
• a token expiring in 30 days (mock timers) keeps the stream open past the 24.8-day timer limit and closes it once time passes exp
• sseMaxConnectionMs still applies without authorization

Fixes #254

🤖 Generated with Claude Code

https://claude.ai/code/session_01UF4S3w7iA83V9DVsasLJzM

[rozzilla]

Long-lived tokens never expire. When exp is more than 24.8 days away, this skips setTimeout() entirely. With no shorter sseMaxConnectionMs, the SSE stream can continue after the token expires. we should schedule a capped timer and reschedule until exp, or reject long delays.

[mcollina]

Fixed in bc55055: the close timer now waits in unref'd steps capped at 2^31-1 ms and reschedules until the deadline (the earlier of exp and sseMaxConnectionMs), and the pending timer is cleared on close. Added a mock-timers test with a token that expires in 30 days: the stream stays open after time moves past the 24.8-day limit and closes once it moves past exp.