[vMCP] Fix resource leak in session storage cleanup (Phase 3)

[yrobla]

Depends on #3865, #3866

Storage.DeleteExpired() removes session metadata but does not release backend client connections, causing a connection leak on session expiry. Fix the cleanup path to call Close() on sessions that own resources.

Fix: In pkg/transport/session/manager.go, perform an optional interface check before deleting each expired session: if closer, ok := sess.(io.Closer); ok { closer.Close() }. This avoids adding Close() to the base Session interface (which would require all existing types t
o implement it) while still dispatching cleanup to sessions that carry resources.

Acceptance Criteria

• DeleteExpired() calls Close() on any session that implements io.Closer before removing it from storage
• Sessions that do not implement io.Closer are deleted without error (no regression for existing session types)
• Backend client connections are released when a session expires (no connection leak)
• Close() errors during cleanup are logged but do not prevent deletion
• Unit tests cover: io.Closer sessions get Close() called, non-io.Closer sessions deleted cleanly, Close() error does not block deletion

---

RFC: THV-0038 — Session-scoped client lifecycle

[yrobla]

Clarification from Phase 1 (PR #3882)

The io.Closer type assertion raised here is now satisfied correctly via the types.Caller interface.

Phase 1 introduced pkg/vmcp/session/types/session.go which defines:

type Caller interface {
    CallTool(...)  (*vmcp.ToolCallResult, error)
    ReadResource(...) (*vmcp.ResourceReadResult, error)
    GetPrompt(...) (*vmcp.PromptGetResult, error)
    Close() error
}

Both backend.Session and MultiSession embed types.Caller, so Close() is promoted through both interface hierarchies. The transportsession.Session embedded in defaultMultiSession does not define Close(), but types.Caller does — so the composite interface is correctly assertable to io.Closer without any additional plumbing.

No code change is needed in Phase 2 for this specific concern, but it is worth verifying in any test that exercises the io.Closer assertion path.