fix(mcp): address SDK migration review

Co-Authored-By: OpenAI Codex (GPT-5) <noreply@openai.com>

operation/operation.go

@@ -41,6 +41,9 @@ const maxRequestBodyBytes = 32 << 20
 // session, and initialize takes no token. Clients re-initialize on the 404.
 const sessionTimeout = 30 * time.Minute
 
+// httpReadHeaderTimeout bounds slow header reads without limiting SSE writes.
+const httpReadHeaderTimeout = 10 * time.Second
+
 var (
 	mcpServer *mcp.Server
 
@@ -111,11 +114,15 @@ func newHTTPServer(addr string, s *mcp.Server) *http.Server {
 		&mcp.StreamableHTTPOptions{
 			Logger:              log.Slog(),
 			MaxRequestBodyBytes: maxRequestBodyBytes,
-			Stateless:           false, // PR 2 switches this on
+			Stateless:           false, // SessionTimeout requires stateful sessions.
 			SessionTimeout:      sessionTimeout,
 		},
 	))
-	return &http.Server{Addr: addr, Handler: mux}
+	return &http.Server{
+		Addr:              addr,
+		Handler:           mux,
+		ReadHeaderTimeout: httpReadHeaderTimeout,
+	}
 }
 
 func Run() error {
@@ -157,6 +164,8 @@ func Run() error {
 }
 
 func newMCPServer(version string) *mcp.Server {
+	// SDK keepalives send MCP ping requests and disconnect clients without a
+	// server-to-client channel, so KeepAlive stays disabled.
 	s := mcp.NewServer(
 		&mcp.Implementation{
 			Name:    "Gitea MCP Server",