v0.2.5 — Streamable HTTP and OAuth tools

Adds stateless MCP Streamable HTTP to the existing /mcp endpoint, with JSON responses by default and optional lazy SSE progress and results. Negotiates protocol versions 2025-11-25, 2025-06-18 and 2025-03-26, validates request media types and configured origins, and handles notifications with HTTP 202.

Tools now receive JSON Schema input validation and can publish structured results, output schemas and metadata. Existing MCP content blocks are preserved; handler failures are logged and returned with a generic message. Optional OAuth authentication reuses naf/oauth-server, including current account permissions, protected-resource metadata and linked-user tools. The MCP POST route supplies its own narrow CSRF exemption.

Upgrade notes: requires PHP 8.3+ and naf/framework 0.2.8+. Clients must send Accept: application/json, text/event-stream and a complete initialize request. Previously tolerated invalid arguments now return JSON-RPC -32602; extra object properties require an explicit schema allowance. GET streaming, sessions and resumability are not implemented.

Validated with 11 tests / 70 assertions, real HTTP streaming checks, Composer validation and style checks. The merged release commit passes CI on PHP 8.3 and 8.5.