refactor: simplify web transports with Starlette

[frostming]

Summary

The HTTP and WebSocket servers currently route agent messages through an in-memory transport pair, pump tasks, a connection registry, and WebSocket multiplex queues, while maintaining a hand-written ASGI adapter. This change connects both transports directly to AgentSideConnection and delegates HTTP/ASGI handling to Starlette.

• Replace ConnectionRegistry/ConnectionState with a connection dictionary and a direct HTTP transport. Keep session routing, bounded SSE buffers, backpressure, keepalives, and cancellation cleanup; use one Future for initialization.
• Use Starlette requests, responses, streaming, WebSocket handling, and lifespan. Add Starlette to the optional [http] extra; core/stdio imports remain independent of web dependencies.
• Add create_asgi_app(agent_factory, *, path="/acp"), sharing the configured route between HTTP and WebSocket, including when mounted under a parent application. Method dispatch follows Starlette routing without a separate check in _get.

Experimental API changes: create_asgi_app() returns a Starlette app; AcpServer handlers return Starlette responses. Remove AcpAsgiApp, PostResult, the registry/state helpers, and create_websocket_connection(). Direct WebSocket integrations use handle_websocket(agent_factory, websocket). The default /acp route replaces the previous catch-all route.

session/load now works over HTTP without requiring a sessionId in its response. Correlate the request ID, keep replay and completion on the connection SSE stream, and provision the session stream for continued prompts. Failed loads clean up provisional streams while preserving existing sessions and overlapping loads. Cover empty/null responses, 1100-message histories, repeated loads, retry after failure, and permission callbacks over HTTP and WebSocket. Agent load responses and capability advertisement are preserved.

Related issues

No linked issue.

Testing

• make test: 256 passed, 1 skipped (optional Gemini test).
• make check: lockfile consistency, pre-commit/Ruff, ty, and deptry passed.
• Coverage includes HTTP/WebSocket prompt streaming and reverse permission requests, initialization interruption, backpressure/close, SSE disconnect and reopen, direct/mounted custom paths, rejection of unrelated paths, lifespan cleanup, and concurrent session success/error routing.
• Checked that core SDK imports work with web dependencies unavailable.

Docs & screenshots

Updated docs/web-transport.md with the simplified architecture, ablation results, API changes, custom paths, and parent/child lifespan mounting example. Updated the HTTP server example. No schema regeneration or screenshots required.

Checklist

• Conventional Commit title (e.g. feat:, fix:).
• Tests cover the change or are not required (explain above).
• Docs/examples updated when behaviour is user-facing.
• Schema regenerations (make gen-all) are called out if applicable (none).