Send one MCP JSON-RPC message

Every request authenticates through the Decionis authority, which checks Accounts-issued OAuth access against current source authority. Caller organization headers cannot establish authority. Query credentials and browser Origin headers are rejected. Supply exactly one Authorization or x-api-key header. Requests have a 100 KiB body limit and finite processing, authority and rate-store bounds. This transport does not support batch messages, GET event streams or resumable sessions. Notifications return 202 without a response body.