[Doc] Update Rails controller example in README.md

[koic]

Motivation and Context

The following two points have been updated:

1. Use ActionController::API in README controller example

ActionController::Base includes CSRF protection which rejects POST requests without an authenticity token. MCP clients do not send CSRF tokens, so the controller example should inherit from ActionController::API instead.

2. Use stateless: true for StreamableHTTPTransport.new

The controller creates a new transport per request, so the session stored on the previous transport is lost. Without stateless: true, the second request with Mcp-Session-Id returns 404 because the new transport has an empty session map.

To share sessions via Mcp-Session-Id across requests, there are two approaches. One is persisting the transport in a class variable. The other is mounting the transport as a Rack app via #263.

Both approaches maintain sessions, so features that depend on server_context within the SDK (Progress, Sampling) work correctly. However, per-request user-specific context such as server_context: { user_id: current_user.id } cannot be passed since the server is shared across all requests.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed