MCP SSE transport POST — JSON-RPC handler for dnakov/claude-mcp.

Client POSTs a JSON-RPC 2.0 message; response is returned as JSON in the HTTP response body (extension reads it directly, not via the SSE stream).

ece2ac0a — a POST carrying its own Authorization header is judged by it alone (a different tenant's session_id is ignored, never handed over). A POST without one may use a live session opened by an authenticated GET; its credential and workspace role are re-checked on every message. Anything else is a 401. Both paths dispatch with the full context POST /mcp uses (read-only tokens, workspace roles, project scope).