fix: pass streamable HTTP auth via http_client

[jstar0]

Summary

• Route streamable HTTP auth headers through the MCP SDK's http_client hook instead of the removed headers argument.
• Keep the SSE transport path unchanged, where sse_client(..., headers=...) is still supported.
• Add focused regression coverage for both transport construction paths.

Changes

• Create an MCP SDK HTTP client with resolved remote auth headers for streamable HTTP probes.
• Pass that client to streamable_http_client(..., http_client=...) and keep it open for the transport/session lifetime.
• Add a focused test that verifies streamable HTTP no longer receives headers=.
• Add a focused SSE regression test to preserve the existing direct-header path.
• Document the fix in the changelog.

Why

mcp>=1.27.2 no longer accepts headers= on streamable_http_client(), so remote streamable HTTP probes fail before any network I/O. The SDK expects callers to configure headers on an httpx.AsyncClient and pass that client via http_client=.

Verification

uv run pytest tests/test_remote_probe_http_session.py -q
uv run pytest tests/test_fuzz_remote.py -q
uv run pytest tests/test_live_probe.py tests/test_remote_probe_http_session.py tests/test_fuzz_remote.py -q
uv run ruff check .
uv run ruff format --check .

Fixes #148