fix(client): make streamable HTTP auth awaits abortable by requestSignal - #2644

The two new `onUnauthorized` catch guards (here and the `_send` sibling at ~line 1169) write the inline `signal?.aborted === true` check that the `isAborted()` helper this same diff introduces was created to replace — its JSDoc cites exactly this check's post-await narrowing hazard, and `_commonHeaders` already uses it. Mechanical fix: replace both inline checks with `isAborted(signal)` so one idiom lands in the diff and the helper's narrowing protection covers all four new abort-check sites.

The changeset only describes the abortable-auth work, but the final commit (2d4fbe7) also bundles a second user-visible behavior fix: the resumption branch of `_send` now threads `onresumptiontoken`/`onRequestStreamEnd` into the resumed GET, so consumers' `onresumptiontoken` callbacks start firing on resume-via-`send()` where they previously never did. Add a sentence to `.changeset/abortable-auth-awaits.md` (or a second changeset) covering the resumption-observer fix so the release notes don't s

The new `UnauthorizedContext.signal` extension point is invisible to the provider authors who need to adopt it: (1) `UnauthorizedContext` is not exported from `@modelcontextprotocol/client` (unlike the sibling context types `OAuthClientInformationContext` / `CrossAppAccessContext`), so consumers can't write a standalone typed `onUnauthorized` implementation; (2) the prose docs that teach `onUnauthorized` (`docs/clients/machine-auth.md:43` and the `AuthProvider` section of `docs/migration/upgrade

The five-line combined-signal computation (transportSignal + the anySignal ternary) is now duplicated verbatim in _startOrAuthSse (lines 619-623) and _send (lines 1093-1097) — and this PR had to move both copies in lockstep to hoist them above their _commonHeaders calls. Consider extracting a small private helper, e.g. _combinedSignal(requestSignal?: AbortSignal): AbortSignal | undefined, called from both sites (and terminateSession as the degenerate no-requestSignal case) so the GET and POST pa

Genuine (non-abort) failures escaping the fire-and-forget `_startOrAuthSse` in this resumption-branch `.catch` (and the 202/initialized sibling at ~line 1259) fire `onerror` twice — `_startOrAuthSse`'s internal catch already emits before rethrowing — and on the resume path `options?.onRequestStreamEnd?.()` is never invoked when the resume GET fails outright (fetch rejection, non-401/403/405 HTTP error, exhausted auth retry), so the per-request stream dead-ends silently despite the observer threa