fix: reject duplicate initialize requests

[he-yufeng]

Fixes #961.

Summary

• Reject a second initialize request after a session has already stored its initial parameters.
• Keep the original InitializeParams intact when a duplicate request tries to change client info, capabilities, or protocol version.
• Add a regression test that exercises a raw JSON-RPC connection and verifies the duplicate request returns an error.

Tests

• go test ./mcp -run TestServerRejectsDuplicateInitialize -count=1
• go test ./mcp -run "TestServerRejectsDuplicateInitialize|TestClientRootCapabilities" -count=1
• go test ./mcp -count=1
• go test ./...
• git diff --check

[guglielmo-san]

Is this a duplicate of PR #962 ?

[he-yufeng]

Yes, this is a duplicate of #962. I opened #973 from the same issue after #962 had already converged, so I'm closing this one and keeping the approved #962 as the active PR. Thanks for catching it.