fix: allow concurrent streamable http requests

[nickcoai]

Summary

The streamable http client waits for each POST to finish before starting the next one. When a server returns application/json, one slow response blocks unrelated requests.

Allow several ordinary POSTs to run at once. StreamableHttpClientTransportConfig::max_concurrent_requests defaults to 16. Set it to 1 to keep ordinary POSTs serial; 0 is treated as 1. An open sse response stream does not count against this limit.

Cancellation and replies to server requests use a separate bounded queue with one extra POST slot. The transport signals local cancellation before queuing the notification. Each control POST has a five-second timeout after it starts. Initialization and requests that change the protocol version still run in order with ordinary POSTs; replies remain available when an active request needs them.

If several ordinary POSTs report an expired session (http 404), they share one recovery attempt. Wait up to session_recovery_timeout for old POSTs to finish, then stop any that remain and return SessionRecoveryTimeout. Do not retry those interrupted POSTs: the server may have processed them. Create one new session and retry only the POSTs that returned SessionExpired, at most once each. The timeout defaults to five seconds, and the replacement handshake gets a separate timeout of the same length. Control POSTs and other POST failures are not retried.

The shared worker gains an opt-in control queue. The server worker keeps its current behavior. Callers still decide which tools may run at the same time and which need approval.

Tests

Passed locally:

• cargo +1.96 test --offline -p rmcp --no-default-features --features client,transport-streamable-http-client --test test_streamable_http_client_concurrency (13 passed)
• cargo +1.96 test --offline --all-features
• Complete non-local feature matrix from justfile, with -- --test-threads=1
• cargo +1.96 clippy --offline --all-targets --all-features -- -D warnings
• cargo +nightly fmt --all -- --check

The parallel non-local run hit the existing JavaScript test's one-second server startup wait. The isolated test and the complete serial run passed. An additional non-local clippy run reports existing lints in the unchanged server tower.rs.