Allow stateless HTTP CORS parameter headers

[leehack]

Summary

• include MCP 2026 stateless routing headers in StreamableMcpServer CORS allow-list
• echo syntactically valid requested preflight headers so browser clients can send tool-specific Mcp-Param-* headers
• cover stateless routing and parameter header preflight behavior

Validation

• dart format .
• dart analyze
• git diff --check
• dart test test/server/streamable_mcp_server_test.dart --name "CORS preflight allows stateless routing and parameter headers"
• dart test test/server/streamable_mcp_server_test.dart
• dart test test/server/streamable_https_test.dart
• dart test test/client/streamable_https_test.dart
• dart test test/mcp_2026_07_28_test.dart
• dart test
• (cd packages/mcp_dart_cli && dart run mcp_dart_cli:mcp_dart conformance --suite all --json)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.36%. Comparing base (415068f) to head (271147f).

Additional details and impacted files

@@                             Coverage Diff                             @@
##           spec/stateless-http-nested-meta-headers     #230      +/-   ##
===========================================================================
+ Coverage                                    88.34%   88.36%   +0.02%     
===========================================================================
  Files                                           47       47              
  Lines                                         9277     9294      +17     
===========================================================================
+ Hits                                          8196     8213      +17     
  Misses                                        1081     1081              

Flag	Coverage Δ
unittests	88.36% <100.00%> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[leehack]

Closing this draft micro PR because the RC spec work has been consolidated into a smaller reviewable stack. This change is preserved in #270 (JSON-RPC metadata hardening); the consolidated tip is tree-identical to the previous micro-stack tip.