SseServerTransport now takes max_request_body_size (default 4 MiB, the
same default and validation as StreamableHTTPSessionManager) and answers
413 before session lookup or parsing when a POST declares or streams a
larger body. The message endpoint only ever handled POST bodies, so it
now answers 405 (Allow: POST) to other methods instead of treating them
like a POST.
MCPServer.sse_app(), run_sse_async() and run(transport="sse") expose the
keyword, mirroring streamable_http_app().
Max Isbey