fix(transport): target resource update notifications

[Anand-0037]

Summary

Fixes notifications/resources/updated delivery so resource updates are sent only to subscribed clients instead of all initialized sessions. Servers can define which update URIs are sub-resources of a subscribed URI; exact URI matching works by default.

Changes

• Add a dedicated bidirectional SubscriptionStore.
• Track authorized resources/subscribe and resources/unsubscribe requests without tying subscriptions to response correlation.
• Route resource updates to exact URI subscribers and, when configured, subscribers matched by the server's matchesSubResource callback. Deduplicate clients matching both.
• Drop malformed, unknown, and no-subscriber updates instead of falling through to generic broadcast.
• Remove subscriptions on session eviction, including probe-timeout removal, and clear them when the transport closes.
• Keep existing list-change, logging, progress, and targeted sendNotification behavior unchanged.

Subscriptions intentionally do not veto session eviction, and stale entries from an application-rejected subscribe are tolerated as discussed in #52.

Tests

• Subscription store and broadcaster coverage for exact matching, server-defined parent/child matching, unrelated URIs, deduplication, and unsubscribe.
• Two-client relay regression coverage, including parent/child delivery and unsubscribe.
• Focused resource-update tests: 15 passed, 0 failed. The probe-timeout/reconnect regression also passed locally.
• Local lint, typecheck, build, verify-exports, publint, formatting, and git diff --check passed.
• GitHub Actions for d43ae78 are awaiting maintainer approval.

Closes #52

[1amKhush]

@Anand-0037 subscriptions survive a probe-timeout session removal. The new cleanup runs in the LRU eviction callback, but a stream probe timeout removes the session directly, bypassing that callback. I reproduced a removed session whose URI still lists the client as a subscriber. If that pubkey establishes a new session, it can receive resource updates without subscribing again. I think you should clear subscriptions on this removal path and add a timeout/reconnect test.

[Anand-0037]

Thanks, I missed the direct session removal in the probe-timeout path. I've cleared subscriptions there and added a regression for reconnecting with the same key; resource updates are no longer delivered until the client subscribes again.

[1amKhush]

@Anand-0037 Parent resource subscriptions miss valid sub-resource updates. The broadcaster performs an exact URI lookup, but MCP allows an update URI to identify a sub-resource of the subscribed URI. See the official MCP schema.

I reproduced this case:

• Client subscribes to resource://repo
• Server updates resource://repo/child
• No notification is delivered because only getSubscribers('resource://repo/child') is checked
  The implementation needs a way to resolve server-defined parent/sub-resource relationships and a regression test for this case.

I recommend fixing the finding before merge.

[Anand-0037]

@1amKhush Fixed in d43ae78. I added optional server-defined sub-resource matching while keeping exact URI matching as the default, with regression coverage for parent/child delivery, unrelated URIs, deduplication, and unsubscribe. The new GitHub Actions runs are awaiting maintainer approval.

[1amKhush]

@ContextVM-org Lgtm for merge