feat: run identify hook per event and drop session identity cache

[naji247]

Summary

• Collapses the stateful/stateless split in identify_session so the configured identify hook runs on every MCP request in both modes. Matches the TypeScript SDK and lets customers refresh identity mid-session (token rotation, impersonation, role changes).
• Removes MCPCatData.identified_sessions entirely. Identity is written directly onto each event by the handler that ran the hook; publish_event's exclude_none=True merge preserves those fields.
• Publishes a mcpcat:identify self-event on every successful identification (one per normal event), so downstream analytics see a distinct identify marker per request.
• Wraps hook invocation, validation, event construction, and publish in a single try/except — identify_session can never raise into a tool call handler.
• get_session_info no longer carries identity fields; they are always None.

Why

The previous stateful path ran the identify hook once per session and short-circuited all later requests, pinning identity to the first call's result and feeding hooks only the first request's context. Customers porting hooks between the Python and TypeScript SDKs hit surprising semantic differences. Unifying on per-event hook execution removes that asymmetry and makes identity reactive to per-request context.

Test plan

• Full suite: uv run pytest tests/ — 349 passed, 2 unrelated skips
• Identify-focused suites: tests/test_stateless.py, tests/test_event_capture_completeness.py, tests/test_session.py
• Zero remaining references to identified_sessions anywhere in src/ or tests/
• Manual smoke: run an MCP server with a stateful (stdio) and stateless (streamable HTTP) transport, configure an identify hook, and confirm the hook is invoked on every request and mcpcat:identify events appear 1:1 with normal events