v4.1.0

`latest` moves from 4.0.0 to 4.1.0. No new flags, and no breaking changes to flags or protocol.

## Behaviour change

* **Each SSE and WebSocket connection now gets its own server process**, as stateful Streamable HTTP sessions already did. Clients no longer share server state or see each other's replies, notifications or requests (#18, #35, #105). A client that reconnects gets a fresh server, so in-memory server state does not survive a reconnect. If you relied on every client sharing one server, review this before upgrading.

## What's Changed

* Relay server-initiated requests (sampling, roots, elicitation), notifications, cancellation and string request ids through WebSocket and both bridges, and stop cutting bridged calls off after 60 seconds
* Stop reading a server's output while its client is not reading: one slow client can no longer exhaust the gateway's memory and take every other client down with it
* A malformed or oversized POST no longer ends an SSE session (#190)
* Escape U+2028/U+2029 in SSE JSON, so clients that split on Unicode line separators no longer cut messages in two (#91)
* With `--sessionTimeout`, ping idle stateful event streams, so a session whose client vanished behind a proxy is still ended (#160)
* Fail an SSE client's in-flight calls as soon as its server exits; close a cancelled call's stream in stateful HTTP
* Keep idle HTTP connections for 65 seconds, past common load balancers' 60, to avoid intermittent resets and 502s
* A `--streamableHttp` bridge reconnects after its upstream restarts and ends its upstream session when it exits (#212)
* Report an SSE upstream that never sends its endpoint event, instead of hanging (#27)
* Stateless HTTP: JSON-RPC batches, the client's protocol version for each server, and one `notifications/initialized` (#85)
* Accept request bodies up to 4 MB in the Streamable HTTP modes and answer rejected bodies with a JSON-RPC error (#163)
* `--header` on every HTTP response; `--sessionTimeout` up to 30 days, non-numeric values refused; path flags without a leading slash; a trailing-slash `--baseUrl`
* Refuse credentials in an upstream URL, pointing to `--header` instead, and never print them
* Read large server output and upstream events in linear time

## Validation

4.1.0-rc.0 cleared a 25-hour soak across Node 20, 22, 24 and 26 on Linux, macOS and Windows: the canary and nine phases, 15 of 15 jobs each, with real MCP servers, the MCP Inspector, Python, Go and Ruby clients, and sustained load, crash and restart scenarios. A manual pass against the published candidate, including the real MCP Inspector through both bridges, also passed. Per-file coverage is held at 100% for lines, statements, functions, branches and MC/DC.

Thanks to:
- [@0xbrainkid](https://github.com/0xbrainkid)
- [@agerit-programator2](https://github.com/agerit-programator2)
- [@aleleba](https://github.com/aleleba)
- [@aneasystone](https://github.com/aneasystone)
- [@Areo-Joe](https://github.com/Areo-Joe)
- [@bimax](https://github.com/bimax)
- [@BishopMartin](https://github.com/BishopMartin)
- [@cosmic-fire-eng](https://github.com/cosmic-fire-eng)
- [@dparkmit24](https://github.com/dparkmit24)
- [@enxilium](https://github.com/enxilium)
- [@essentialols](https://github.com/essentialols)
- [@gcoinstash-cmd](https://github.com/gcoinstash-cmd)
- [@kvick-games](https://github.com/kvick-games)
- [@logan-crosby](https://github.com/logan-crosby)
- [@luyunfeng-bytedance](https://github.com/luyunfeng-bytedance)
- [@MartinZvelebil](https://github.com/MartinZvelebil)
- [@NicoBonaminio](https://github.com/NicoBonaminio)
- [@nowireless4u](https://github.com/nowireless4u)
- [@nullStack65](https://github.com/nullStack65)
- [@oshaban](https://github.com/oshaban)
- [@paul-maas](https://github.com/paul-maas)
- [@rajivml](https://github.com/rajivml)
- [@scalabreseGD](https://github.com/scalabreseGD)
- [@srijan](https://github.com/srijan)
- [@TheItschi](https://github.com/TheItschi)
- [@tttcoding666](https://github.com/tttcoding666)
- [@werebear73](https://github.com/werebear73)
- [@wowsofine](https://github.com/wowsofine)
- [@yanziwei](https://github.com/yanziwei)

**Full Changelog**: https://github.com/supercorp-ai/supergateway/compare/v4.0.0...v4.1.0