Migrate session manager to DataStorage and add RestoreSession

[yrobla]

Summary

Replace the *transportsession.Manager dependency in sessionmanager.Manager with the DataStorage interface (introduced in split PR 1), enabling pluggable session metadata storage (local or Redis) without coupling live session state to the serialization layer.

Key changes:

• Add RestoreSession() to MultiSessionFactory (and decorating/mock impls); refactor makeSession → makeBaseSession so RestoreSession can reconstruct a live session from stored metadata without a bearer token
• Add RestoreHijackPrevention() in pkg/vmcp/session/internal/security to recreate the hijack-prevention decorator from stored hash/salt
• Rewrite sessionmanager.Manager to use DataStorage: node-local RestorableCache[string, MultiSession] for hot-path lookups with singleflight-deduplicated RestoreSession on cache miss and lazy liveness validation via storage.Load() on cache hits
• Extract RestorableCache[K,V] generic type (sync.Map + singleflight + check/evict callbacks) into cache.go
• Wire server.go to create LocalSessionDataStorage and pass it to sessionmanager.New; the discovery middleware continues to use the existing *transportsession.Manager (unchanged in this PR)

Fixes #4220

Type of change

• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation
• Other (describe):

Test plan

• Unit tests (task test)
• E2E tests (task test-e2e)
• Linting (task lint-fix)
• Manual testing (describe below)

Does this introduce a user-facing change?

No. The discovery middleware and its 401 behaviour for unknown/expired sessions are unchanged. Redis wiring and the 401→404 migration are deferred to a follow-up PR.

Special notes for reviewers

Large PR Justification

This is a PR that is part of multiple. It is completely isolated, cannot be split.

[github-actions]

Large PR Detected

This PR exceeds 1000 lines of changes and requires justification before it can be reviewed.

How to unblock this PR:

Add a section to your PR description with the following format:

## Large PR Justification

[Explain why this PR must be large, such as:]
- Generated code that cannot be split
- Large refactoring that must be atomic
- Multiple related changes that would break if separated
- Migration or data transformation

Alternative:

Consider splitting this PR into smaller, focused changes (< 1000 lines each) for easier review and reduced risk.

See our Contributing Guidelines for more details.

---

This review will be automatically dismissed once you add the justification section.

Large PR justification has been provided. Thank you!

[github-actions]

✅ Large PR justification has been provided. The size review has been dismissed and this PR can now proceed with normal review.

[codecov]

Codecov Report

❌ Patch coverage is 55.81395% with 171 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.47%. Comparing base (8b7c40e) to head (e033710).

Files with missing lines	Patch %	Lines
pkg/vmcp/server/sessionmanager/session_manager.go	69.58%	43 Missing and 16 partials ⚠️
pkg/vmcp/session/factory.go	10.63%	41 Missing and 1 partial ⚠️
pkg/vmcp/session/internal/security/security.go	0.00%	29 Missing ⚠️
pkg/vmcp/session/decorating_factory.go	0.00%	17 Missing ⚠️
pkg/transport/session/storage_redis.go	0.00%	7 Missing ⚠️
pkg/transport/session/manager.go	0.00%	6 Missing ⚠️
pkg/transport/session/storage_local.go	0.00%	5 Missing ⚠️
pkg/vmcp/server/sessionmanager/cache.go	92.85%	2 Missing and 1 partial ⚠️
pkg/vmcp/server/server.go	92.85%	1 Missing and 1 partial ⚠️
pkg/vmcp/discovery/middleware.go	91.66%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4464      +/-   ##
==========================================
- Coverage   69.60%   69.47%   -0.13%     
==========================================
  Files         494      495       +1     
  Lines       50445    50733     +288     
==========================================
+ Hits        35111    35249     +138     
- Misses      12638    12777     +139     
- Partials     2696     2707      +11     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR refactors vMCP session lifecycle management to decouple live MultiSession state from persisted session metadata by migrating sessionmanager.Manager to the new transportsession.DataStorage interface, and adds a RestoreSession flow to reconstruct sessions on cache misses (e.g., after restart or cross-pod routing when using Redis-backed metadata).

Changes:

• Replace *transportsession.Manager usage in sessionmanager.Manager with DataStorage, introducing a node-local sync.Map cache plus singleflight-deduped restore on cache miss and a background eviction loop driven by storage.Exists().
• Extend MultiSessionFactory with RestoreSession() and add security.RestoreHijackPrevention() to rebuild the hijack-prevention decorator from persisted token hash/salt.
• Update discovery middleware to depend on a MultiSessionGetter (backed by the session manager) and allow unknown sessions to fall through so the SDK can return 404 via Validate() (tests updated accordingly).

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pkg/vmcp/session/mocks/mock_factory.go	Updates gomock factory to include RestoreSession.
pkg/vmcp/session/internal/security/security.go	Adds RestoreHijackPrevention to rebuild decorator from stored hash/salt.
pkg/vmcp/session/factory.go	Adds MultiSessionFactory.RestoreSession and refactors makeSession → makeBaseSession.
pkg/vmcp/session/decorating_factory.go	Adds decorator-aware RestoreSession implementation.
pkg/vmcp/server/testfactory_test.go	Updates minimal test factory to satisfy new interface.
pkg/vmcp/server/telemetry_integration_test.go	Updates test factory to support RestoreSession.
pkg/vmcp/server/sessionmanager/session_manager.go	Major rewrite: DataStorage + node-local cache + restore + eviction loop + adapted prompts.
pkg/vmcp/server/sessionmanager/session_manager_test.go	Migrates tests to DataStorage and new behaviors.
pkg/vmcp/server/session_management_realbackend_integration_test.go	Updates expected status code after termination (401 → 404).
pkg/vmcp/server/session_management_integration_test.go	Updates expected status code after termination (401 → 404).
pkg/vmcp/server/server.go	Wires server to create LocalSessionDataStorage and pass it to session manager; updates shutdown/handler wiring.
pkg/vmcp/discovery/middleware.go	Switches dependency to MultiSessionGetter; removes 401-on-missing-session behavior.
pkg/vmcp/discovery/middleware_test.go	Reworks tests to use a stub MultiSessionGetter.
pkg/transport/session/storage.go	Adds Exists() to the session-object Storage interface.
pkg/transport/session/storage_redis.go	Implements Storage.Exists() via Redis EXISTS (no TTL refresh).
pkg/transport/session/storage_local.go	Implements Storage.Exists() without refreshing last-access timestamp.
pkg/transport/session/manager.go	Exposes TTL() and adds Manager.Exists() wrapper.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 5 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated 5 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 19 out of 19 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.