Reorganize sessions.md and use endpoint filter with Activity tag

Restructure document flow: move client-side behavior up, fold security
into server configuration, move legacy SSE to its own section near the
end. Replace middleware example with minimal API endpoint filter using
Activity.AddTag for the transport session ID. Migrate SSE anchors
across transports.md, list-of-diagnostics.md, and filters.md.

Fix endpoint filter test to avoid strict request count assertion.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: halter73