### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

The MCP server enforces a per-"owner" cap of 100 concurrent stateful sessions (_MAX_STATEFUL_SESSIONS_PER_OWNER = 100), where "owner" is computed by _owner_fingerprint_for as a hash of the API key alone.

This means all callers sharing a single API key (e.g., a team using a shared service account key, or a key distributed to multiple IDE plugin users) are collapsed into a single bucket. The 100-session limit is shared across every user behind that key — not per-user — causing legitimate users to receive 429 errors once the collective pool is exhausted.

**Two specific failure modes result:** 1. Silent eviction: When the shared bucket fills, the oldest idle sessions belonging to other users are evicted without any notification to those users. 2. Hard rejection: If every session in the shared bucket is actively in-flight, the next initialize is rejected with 429 — even though the user who sent it may have zero active sessions of their own.

**Request:** 1. Allow _MAX_STATEFUL_SESSIONS_PER_OWNER to be override via an environment value. 2. Allow a…