fix(mcp): ignore zero-quality Accept ranges in the session takeover guard

Addresses a thirteenth automated review finding: `application/json;q=0`
explicitly refuses JSON, so it no longer counts toward the exact Accept ranges
a session takeover requires.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/server/http/serveStreamableHttp.ts

@@ -115,10 +115,20 @@ const SHUTTING_DOWN = (): Response =>
 /** The media type proper of one header value or Accept range: no parameters, lowercase. */
 const mediaType = (value: string): string =>
   (value.split(";")[0] ?? "").trim().toLowerCase();
+/** An Accept range's quality weight; a missing or unreadable `q` counts as 1, as in RFC 9110. */
+const quality = (range: string): number => {
+  const q = /;\s*q\s*=\s*([0-9.]+)/iu.exec(range)?.[1];
+  const value = q === undefined ? 1 : Number(q);
+  return Number.isFinite(value) ? value : 1;
+};
 const hasStreamablePostHeaders = (request: Request): boolean => {
-  // Exact media ranges and type: `application/json-patch+json` or `text/event-streaming` do not count.
+  // Exact media ranges with a positive weight: `application/json-patch+json`, `text/event-streaming`
+  // and `application/json;q=0` do not count.
   const accepted = new Set(
-    (request.headers.get("accept") ?? "").split(",").map(mediaType),
+    (request.headers.get("accept") ?? "")
+      .split(",")
+      .filter((range) => quality(range) > 0)
+      .map(mediaType),
   );
   return (
     accepted.has("application/json") &&