docs: document MCP_GATEWAY_SESSION_TIMEOUT environment variable (#3153)

`MCP_GATEWAY_SESSION_TIMEOUT` was used in `internal/server/transport.go`
to configure unified mode session lifetime but was absent from all
documentation, leaving users with no visibility into this tuning knob.

## Changes

- **`docs/ENVIRONMENT_VARIABLES.md`** — Added entry to the "Optional
(Non-Containerized Mode)" table clarifying it applies only to unified
mode (`/mcp`), accepts Go duration strings, defaults to `2h`, and that
routed mode is unaffected (hardcoded 30 min)
- **`AGENTS.md`** — Added matching bullet entry in the Environment
Variables section for agent/dev reference

Author: lpcox

AGENTS.md

@@ -376,6 +376,7 @@ DEBUG_COLORS=0 DEBUG=* ./awmg --config config.toml
 - `MCP_GATEWAY_PAYLOAD_DIR` - Large payload storage directory (sets default for `--payload-dir` flag, default: `/tmp/jq-payloads`)
 - `MCP_GATEWAY_PAYLOAD_PATH_PREFIX` - Path prefix for remapping payloadPath returned to clients (sets default for `--payload-path-prefix` flag, default: empty)
 - `MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD` - Size threshold in bytes for payload storage; payloads larger than this are stored to disk (sets default for `--payload-size-threshold` flag, default: `524288`)
+- `MCP_GATEWAY_SESSION_TIMEOUT` - Session timeout for unified mode (`/mcp`) stateful sessions. Accepts Go duration strings (e.g., `30m`, `1h`, `2h30m`). Routed mode is unaffected (hardcoded 30 min). (default: `2h`)
 - `DOCKER_HOST` - Docker daemon socket path (default: `/var/run/docker.sock`)
 - `MCP_GATEWAY_GUARDS_SINK_SERVER_IDS` - Comma-separated server IDs whose RPC JSONL logs should include agent secrecy/integrity tag snapshots (sets default for `--guards-sink-server-ids`)
 - `MCP_GATEWAY_GUARDS_MODE` - Guards enforcement mode: `strict` (deny violations), `filter` (remove denied tools), `propagate` (auto-adjust agent labels) (sets default for `--guards-mode`, default: `strict`)

docs/ENVIRONMENT_VARIABLES.md

@@ -25,6 +25,7 @@ When running locally (`run.sh`), these variables are optional (warnings shown if
 | `MCP_GATEWAY_PAYLOAD_DIR` | Large payload storage directory (sets default for `--payload-dir` flag) | `/tmp/jq-payloads` |
 | `MCP_GATEWAY_PAYLOAD_PATH_PREFIX` | Path prefix for remapping payloadPath returned to clients (sets default for `--payload-path-prefix` flag) | (empty - use actual filesystem path) |
 | `MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD` | Size threshold in bytes for payload storage (sets default for `--payload-size-threshold` flag) | `524288` |
+| `MCP_GATEWAY_SESSION_TIMEOUT` | Session timeout for unified mode (`/mcp`) stateful sessions. Accepts Go duration strings (e.g., `30m`, `1h`). Default is 2 hours to accommodate long-running agentic workflows. Routed mode is unaffected (hardcoded 30 min). | `2h` |
 | `MCP_GATEWAY_WASM_GUARDS_DIR` | Root directory for per-server WASM guards (`<root>/<serverID>/*.wasm`, first match is loaded) | (disabled) |
 | `MCP_GATEWAY_GUARDS_MODE` | Guards enforcement mode: `strict` (deny violations), `filter` (remove denied tools), `propagate` (auto-adjust agent labels) (sets default for `--guards-mode`) | `strict` |
 | `MCP_GATEWAY_GUARDS_SINK_SERVER_IDS` | Comma-separated sink server IDs for JSONL guards tag enrichment (sets default for `--guards-sink-server-ids`) | (disabled) |