test(integration): mocktool JSON-RPC + federated /mcp coverage (SF4)

mocktool's 'tool' mode gains two federated-/mcp JSON-RPC endpoints:
'/' (lenient — every bare, session-less call succeeds, matching 8 of
11 real servers the live probe found) and '/strict' (session-required
— rejects a bare tools/list/tools/call with a JSON-RPC error until a
prior 'initialize' call's Mcp-Session-Id header accompanies it,
matching readitall/fetch's real behavior). A new 'toolstrict'
MCPServers entry in dynamic.yml.tmpl points at '/strict'.

TestFederatedMCP drives POST /mcp against real Traefik+Yaegi: a
federated tools/list must include both tool_echo (bare path) and
toolstrict_echo (reachable only via the plugin's own
bare-first-with-fallback handshake retry, mcp_federation.go's
mcpBackendCall), and a tools/call to toolstrict_echo must route
correctly with the prefix stripped. Closes the review gap ('only
goroutine in the package, zero real-interpreter coverage') the
go-test-only suite left: the handshake fallback, and the plugin's
goroutine fan-out in mcpFederatedToolsList, now both run for real
under Yaegi, not just against go test's in-process mocks.

Verified: make integration — ok github.com/lukaszraczylo/
traefik-llmgateway/integration 40.113s, exit 0, no FAIL/panic/skip in
the full run.

integration/traefik/dynamic.yml.tmpl

@@ -120,6 +120,19 @@ http:
           mcpServers:
             tool:
               url: "http://mocktool:8080"
+            # toolstrict backs the federated-/mcp handshake-fallback
+            # integration coverage (SF4, review round 2, v0.21): mocktool's
+            # own "/strict" route (integration/mock/main.go's
+            # handleToolJSONRPCStrict) rejects a bare, session-less
+            # tools/list or tools/call with a JSON-RPC error and only
+            # honors one carrying a session id its own "initialize"
+            # issued — the same shape readitall/fetch answer live, and the
+            # exact trigger the plugin's bare-first-with-fallback retry
+            # (mcp_federation.go's mcpBackendCall) exists for. Proves that
+            # retry works under real Traefik+Yaegi, not just go test's own
+            # mocks.
+            toolstrict:
+              url: "http://mocktool:8080/strict"
           # v0.2 features (spec §1, §2, §4, §5), all opt-in and off by
           # default in v0.1: enabled here so the integration suite
           # exercises every one under real Traefik+Yaegi, not just go