feat: add --only and --exclude to narrow the served catalog

A proxy that publishes every backend is right for a human at a terminal and
wrong for a model. Each tool costs context, and past a few hundred the client
starts hiding tools behind a lookup step, so one answer becomes several round
trips. An agent that only needs roam and github should not pay for the rest.

Both flags take comma-separated server names on mcp serve. `--only` runs first,
then `--exclude`. An unknown name gets logged as a warning instead of being
dropped quietly, because a typo would serve a catalog missing a whole backend
and that failure reads as "the model stopped using that tool".

Version goes to 0.6.2.

Signed-off-by: Avelino <31996+avelino@users.noreply.github.com>

pkg: upgrade deps

Signed-off-by: Avelino <31996+avelino@users.noreply.github.com>

Bump tar from 0.4.45 to 0.4.46 in the cargo group across 1 directory

Bumps the cargo group with 1 update in the / directory: [tar](https://github.com/composefs/tar-rs).


Updates `tar` from 0.4.45 to 0.4.46
- [Release notes](https://github.com/composefs/tar-rs/releases)
- [Commits](composefs/tar-rs@0.4.45...0.4.46)

---
updated-dependencies:
- dependency-name: tar
  dependency-version: 0.4.46
  dependency-type: indirect
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>

Honor explicit audit.output value in mcp serve

Signed-off-by: Avelino <31996+avelino@users.noreply.github.com>

Pin fmt layer writer to stderr

tracing-subscriber's default writer is stdout, so logs were leaking into the JSON-RPC stream when mcp serve runs over stdio. The doc comment already promised stderr, so the code was lying about its own behavior.

Set with_writer(`std::io::stderr`) explicitly on both json and text branches.

Signed-off-by: Avelino <31996+avelino@users.noreply.github.com>

Address PR #95 code review feedback

Signed-off-by: Avelino <31996+avelino@users.noreply.github.com>