docs: address review nits on the v2/main merge

- transport.ts: update the SSE-branch comment to say the default path uses
  fetchWithOptionalAuthIntercept (proxy-aware baseFetch + optional auth-challenge
  intercept), not the bare proxy-aware baseFetch.
- clients/cli/README.md: fix the §5 mid-session validation link to use the
  ../../specification/ prefix like the sibling links in the same sentence
  (previously resolved to a nonexistent clients/cli/ path).

Both flagged by the @claude review of PR #1601; comment/doc-only, no runtime change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S3fTN8H3R8YV4yUGvZjYnX

core/mcp/node/transport.ts

@@ -148,7 +148,8 @@ export function createTransportNode(
     const url = new URL(sseConfig.url);
 
     // A caller-supplied eventSourceInit.fetch wins as-is (explicit fetch is not
-    // re-wrapped for proxying); the default path uses the proxy-aware baseFetch.
+    // re-wrapped for proxying); the default path uses fetchWithOptionalAuthIntercept
+    // (the proxy-aware baseFetch plus the optional auth-challenge intercept).
     const sseFetch =
       (sseConfig.eventSourceInit?.fetch as typeof fetch) ||
       fetchWithOptionalAuthIntercept;