fix: map HeaderMismatch to HTTP 400

[lucarlig]

Map handler-generated JSON-RPC HeaderMismatch errors (-32020) to HTTP 400 on the modern per-request Streamable HTTP path. Add an integration test that exercises a valid 2026-07-28 request reaching a handler and verifies both the HTTP status and JSON-RPC error code.

Fixes #1225.

Motivation and Context

The MCP 2026-07-28 Streamable HTTP server-validation rules require header-validation failures to return HTTP 400 with JSON-RPC error code -32020.

RMCP already returns that combination when its transport detects a mismatch before dispatch. However, when application validation returns ErrorData::header_mismatch(...) from a ServerHandler, the response flows through jsonrpc_http_status, where HEADER_MISMATCH previously fell through to HTTP 200.

This change adds HEADER_MISMATCH to the modern bad-request mapping. Legacy requests continue to bypass this mapper and retain their existing HTTP 200 JSON-RPC behavior.

Specification:

https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http#server-validation

How Has This Been Tested?

The new regression test failed against unmodified main with HTTP 200 instead of 400, then passed after the mapper change.

Ran:

cargo test -p rmcp --test test_streamable_http_json_response --features 'server client transport-streamable-http-server reqwest'
cargo clippy -p rmcp --all-features --all-targets -- -D warnings
cargo fmt --all -- --check
git diff --check

Results: 7 tests passed; Clippy, formatting, and whitespace checks passed. Stable rustfmt emitted the repository's existing warnings for nightly-only configuration options.

Breaking Changes

None. This corrects the HTTP status for an existing modern JSON-RPC error response. The JSON-RPC error code and legacy response behavior are unchanged.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

Related transport-level validation paths already construct HTTP 400 responses directly. The new test specifically covers a HeaderMismatch returned after handler dispatch.