MCP 2025-11-25 specification compliance

Updates for full compliance with MCP 2025-11-25 Streamable HTTP transport:

Protocol:
- Updated to protocol version 2025-11-25 (latest)
- Backwards compatible: 2025-03-26, 2024-11-05
- Invalid protocol version now returns 400 Bad Request (strict mode)

Headers:
- Session header renamed to MCP-Session-Id (correct casing per spec)
- MCP-Protocol-Version header required on all requests

Origin validation (per 2025-11-25):
- Origin header only validated IF present
- If present and invalid: 403 Forbidden
- If not present: acceptable (no 403)

SSE (per 2025-11-25):
- Priming event with empty data and event ID sent first
- retry: field added for polling behavior
- Event IDs for resumability

Passes 14/15 compliance checks (93%)

Author: alokemajumder