docs: explain why GET /api/mcp deliberately answers 405 in stateless mode

server/internal/api/handlers.go

@@ -126,6 +126,15 @@ func RegisterRoutes(r *gin.Engine) {
 		// activity and RequireScopes all apply from where it lives rather than
 		// because someone remembered. The route-level scope is a floor: one route
 		// serves many tools, so per-tool scopes are enforced inside the handler.
+		//
+		// GET is registered deliberately even though the transport runs stateless
+		// and therefore never serves it usefully: mcp.Handler's underlying SDK
+		// handler answers every GET with a hardcoded 405, because a stateless
+		// server has no session to open the server-to-client SSE stream against.
+		// That 405 is the protocol-correct response for an MCP server that offers
+		// no SSE leg — an unregistered GET would 404 instead, which a client reads
+		// as "no MCP endpoint here at all" rather than "this one is POST-only".
+		// This route is not a working GET; it exists solely to produce that 405.
 		mcpGroup := apiGroup.Group("/mcp", RequireFeature(license.FeatureMCP))
 		mcpGroup.POST("", mcp.Handler())
 		mcpGroup.GET("", mcp.Handler())