Add Session and SessionFactory interfaces for vMCP (Phase 1)

Implements issue #3865 and RFC THV-0038 (session-scoped client
lifecycle). This is a purely additive Phase 1 change introducing
the session layer to pkg/vmcp/session/:

  - session.go: Session interface extending transportsession.Session,
    documenting the dual-layer model (serialisable metadata vs.
    non-serialisable runtime state) and the sticky-session constraint
    for distributed deployments.

  - factory.go: SessionFactory interface, BackendConnector injectable
    function type, and defaultSessionFactory. Backends are initialised
    in parallel using errgroup with bounded concurrency (default 10).
    Partial initialisation: failed backends are logged and skipped so
    the session proceeds with the remaining healthy backends.

  - default_session.go: Thread-safe defaultSession with a RWMutex +
    WaitGroup pattern that ensures wg.Add(1) is always called while
    holding the read lock, preventing races between in-flight operations
    and Close().

  - connector.go: mcpConnectedBackend wrapping a persistent mark3labs
    mcp-go client, NewHTTPBackendConnector with a layered HTTP transport
    chain (auth → identity propagation → 100 MB response size cap), and
    initAndQueryCapabilities for the MCP Initialize handshake and
    tool/resource/prompt discovery.

Closes: #3865

Author: taskbot