test(vmcp): cover client response posts

[jstar0]

Summary

Valid JSON-RPC responses sent by Streamable HTTP clients used to pass through a
request-only authorization layer, which rejected them as malformed and broke
server-initiated MCP requests. The production vMCP handler no longer installs
that legacy layer after #5556, but the client-response path had no end-to-end
regression coverage.

This adds a production-handler integration test that opens a real Streamable
HTTP client, triggers server-initiated elicitation during a tool call, and sends
the correlated client response back through the /mcp endpoint.

Changes

The test verifies that:

• the client response POST returns 202 Accepted with an empty body;
• the elicitation response is correlated and delivered to the server;
• the outer tool call completes with the expected result; and
• configuring the retired request-only authorization middleware does not put it
  back into the production handler chain.

The change is test-only and does not modify runtime behavior.

Verification

go test -race ./pkg/vmcp/server -run '^TestHandler_AcceptsClientResponsePostWithLegacyAuthzConfigured$' -count=1
go test -race ./pkg/vmcp/server -count=1

Closes #5009