Bug Summary

POST /mcp?sessionId=... can panic with runtime error: invalid memory address or nil pointer dereference in internal/server/mcp.go.

Impact

This crashes request handling for SSE-backed MCP flows in staging and returns HTTP 500 to clients after successful /mcp/sse session bootstrap.

Reproduction

1. GET /mcp/sse and capture sessionId from event: endpoint.
2. POST /mcp?sessionId=<id>.
3. Observe panic in logs from (*sseManager).get around mcp.go:64.

Proposed Fix

• Make sseManager.get nil-safe (treat nil map entries as unavailable).
• Return HTTP 400 when sessionId is provided but session is unavailable, instead of continuing.
• Add a regression test for nil session map values.