🚨 HOTFIX v2.19.2: Fix critical session cleanup stack overflow (#316)

* fix: Fix critical session cleanup stack overflow bug (v2.19.2)

This commit fixes a critical P0 bug that caused stack overflow during
container restart, making the service unusable for all users with
session persistence enabled.

Root Causes:
1. Missing await in cleanupExpiredSessions() line 206 caused
   overlapping async cleanup attempts
2. Transport event handlers (onclose, onerror) triggered recursive
   cleanup during shutdown
3. No recursion guard to prevent concurrent cleanup of same session

Fixes Applied:
- Added cleanupInProgress Set recursion guard
- Added isShuttingDown flag to prevent recursive event handlers
- Implemented safeCloseTransport() with timeout protection (3s)
- Updated removeSession() with recursion guard and safe close
- Fixed cleanupExpiredSessions() to properly await with error isolation
- Updated all transport event handlers to check shutdown flag
- Enhanced shutdown() method for proper sequential cleanup

Impact:
- Service now survives container restarts without stack overflow
- No more hanging requests after restart
- Individual session cleanup failures don't cascade
- All 77 session lifecycle tests passing

Version: 2.19.2
Severity: CRITICAL
Priority: P0

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* chore: Bump package.runtime.json to v2.19.2

* test: Fix transport cleanup test to work with safeCloseTransport

The test was manually triggering mockTransport.onclose() to simulate
cleanup, but our stack overflow fix sets transport.onclose = undefined
in safeCloseTransport() before closing.

Updated the test to call removeSession() directly instead of manually
triggering the onclose handler. This properly tests the cleanup behavior
with the new recursion-safe approach.

Changes:
- Call removeSession() directly to test cleanup
- Verify transport.close() is called
- Verify onclose and onerror handlers are cleared
- Verify all session data structures are cleaned up

Test Results: All 115 session tests passing ✅

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

tests/unit/http-server-session-management.test.ts

@@ -631,15 +631,16 @@ describe('HTTP Server Session Management', () => {
   describe('Transport Management', () => {
     it('should handle transport cleanup on close', async () => {
       server = new SingleSessionHTTPServer();
-      
-      // Test the transport cleanup mechanism by setting up a transport with onclose
+
+      // Test the transport cleanup mechanism by calling removeSession directly
       const sessionId = 'test-session-id-1234-5678-9012-345678901234';
       const mockTransport = {
         close: vi.fn().mockResolvedValue(undefined),
         sessionId,
-        onclose: null as (() => void) | null
+        onclose: undefined as (() => void) | undefined,
+        onerror: undefined as ((error: Error) => void) | undefined
       };
-      
+
       (server as any).transports[sessionId] = mockTransport;
       (server as any).servers[sessionId] = {};
       (server as any).sessionMetadata[sessionId] = {
@@ -647,18 +648,16 @@ describe('HTTP Server Session Management', () => {
         createdAt: new Date()
       };
 
-      // Set up the onclose handler like the real implementation would
-      mockTransport.onclose = () => {
-        (server as any).removeSession(sessionId, 'transport_closed');
-      };
+      // Directly call removeSession to test cleanup behavior
+      await (server as any).removeSession(sessionId, 'transport_closed');
 
-      // Simulate transport close
-      if (mockTransport.onclose) {
-        await mockTransport.onclose();
-      }
-
-      // Verify cleanup was triggered
+      // Verify cleanup completed
       expect((server as any).transports[sessionId]).toBeUndefined();
+      expect((server as any).servers[sessionId]).toBeUndefined();
+      expect((server as any).sessionMetadata[sessionId]).toBeUndefined();
+      expect(mockTransport.close).toHaveBeenCalled();
+      expect(mockTransport.onclose).toBeUndefined();
+      expect(mockTransport.onerror).toBeUndefined();
     });
 
     it('should handle multiple concurrent sessions', async () => {