test(mcp): pin session concurrency, document error codes, assert id round-trip

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/mcp/session_test.go

@@ -1,6 +1,7 @@
 package mcp_test
 
 import (
+	"sync"
 	"testing"
 
 	"gitea.d-ma.be/mathias/gitea-mcp/internal/mcp"
@@ -20,3 +21,26 @@ func TestSessionStoreIssueAndCheck(t *testing.T) {
 	s.Drop(id)
 	assert.False(t, s.Valid(id))
 }
+
+func TestSessionStoreConcurrency(t *testing.T) {
+	s := mcp.NewSessionStore()
+
+	const goroutines = 32
+	const perGoroutine = 100
+
+	var wg sync.WaitGroup
+	wg.Add(goroutines)
+	for i := 0; i < goroutines; i++ {
+		go func() {
+			defer wg.Done()
+			for j := 0; j < perGoroutine; j++ {
+				id := s.Issue()
+				if !s.Valid(id) {
+					t.Errorf("issued id %s reported invalid", id)
+				}
+				s.Drop(id)
+			}
+		}()
+	}
+	wg.Wait()
+}