fix: handle Sec-WebSocket-Protocol header in MCP WebSocket handshake
The MCP SDK's WebSocketClientTransport uses the 'mcp' subprotocol when
connecting. Per the WebSocket spec, when a client requests a subprotocol,
the server must echo it back in the handshake response.
This fix:
- Parses the Sec-WebSocket-Protocol header from client handshake
- Echoes back the accepted protocol in the 101 response
- Uses string_starts_with for safer header matching
Without this, browsers reject the WebSocket connection because the
handshake doesn't properly negotiate the requested subprotocol.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>