Bump express to 5.2.1

[Evanfeenstra]

Why

On Express 4, a rejected promise from an async route handler becomes an unhandled rejection, which kills the whole process on Node ≥15. Several handlers (e.g. /repo/describe) have awaits or throwing calls before their try blocks, so one bad request could take down the server (see #1485 for the specific instance). Express 5 forwards async handler rejections to error middleware, closing the whole bug class at once.

Changes

• express 4.22.1 → 5.2.1 (pinned). @types/express was already at 5.0.6; no type changes needed. @modelcontextprotocol/sdk already depends on express 5, so the tree now dedupes to a single copy — the lockfile diff is just express 4's transitive tree being removed.
• Renamed the benchmark UI catch-all /sessions/* → /sessions/*splat (path-to-regexp v8 requires named wildcards; the old syntax throws at boot). Only route in the repo affected — no other wildcards, optional params, regex paths, or removed APIs (req.param, res.sendfile, etc.) in use.
• Added a terminal error-handling middleware after all routes: logs the error with stack, returns a JSON 500 (or just ends the connection if headers were already sent, e.g. SSE / fire-and-forget jobs).

Verification

• Server boots; /health, param routes, 404s, and validation 400s behave as before
• The former crash scenario — POST /repo/describe with a model whose provider has no API key — now returns a JSON 500 with the error logged, and the server stays up
• /sessions/foo/bar matches through the renamed wildcard route
• test:node suite: 231/231 pass
• Query parser default change (extended → simple) is a non-issue: all multi-value query params are comma-split strings, and express.urlencoded already passes extended: true explicitly

🤖 Generated with Claude Code