[MCP] listChanged notifications + per-session bookkeeping #619

Scope. Per-session bookkeeping for active MCP sessions, plus the two listChanged notification flows: notifications/tools/list_changed when a role mutates and notifications/resources/list_changed when the schema mutates.

Design reference. Section "tools/list_changed session bookkeeping" in #465.

Acceptance criteria

• In-memory session table keyed by Mcp-Session-Id: { user, role, profile, sseStream? }. Idle sessions terminated per mcp.session.idleTimeoutSeconds.
• Subscribe to Harper's existing role-cache-invalidation events (security/user.ts); on event, recompute tools/list for affected sessions, diff against the cached list, send notifications/tools/list_changed over each session's SSE channel.
• Subscribe to Harper's existing schema-reload events (create_schema / create_table / drop_table / GraphQL reload); on event, recompute resources/list for affected sessions and send notifications/resources/list_changed.
• Never broadcast. Notifications are computed per-session so users never learn about schema/role changes for objects they cannot see.
• Sessions reaching idle timeout return HTTP 404 on subsequent requests (per the transport spec from [MCP] Streamable HTTP transport: session, lifecycle, Origin, contentTypes reuse #614).
• Unit + integration tests: open two sessions with different roles; mutate one role; verify only the affected session receives notifications/tools/list_changed.

Out of scope. Resumability via Last-Event-ID (v2). resources/subscribe (v2). Cross-process session sharing (v2).

Stacks on. #615, #616, #617, #618 (needs both profiles' tool lists and the resources capability).

Branch & PR conventions

• Branch: feat/mcp-listchanged-sessions
• PR base: main (after dependencies merge).
• Closes this issue; references Expose Operations (API) through an MCP Wrapper #465.

Smoke test

# Open SSE on session A; alter_role for the user attached to session A in another session B.
# Expected: SSE event "notifications/tools/list_changed" arrives on session A's GET /mcp stream.
# Session A's next tools/list returns the new filtered set.

Tracking. Part of #465. Sub-issue #7 of 11.