fix(serve): answer tools/list from cache during the background refresh

After startup the proxy loads tools from the persistent cache, then the
background refresh calls `reset_cache_loaded_for_refresh`, which removes every
cache-loaded backend from `discovered_backends`. A `tools/list` arriving in
that window saw `has_undiscovered_backends() == true` and blocked on
`discover_pending_backends` until every backend had been spawned and listed -
exactly the wait the cache exists to avoid. With 9 backends that is 5-12 s per
proxy restart, long enough for a client's tools fetch to time out.

`tools/list` now asks `has_backends_without_tools()`: like
`has_undiscovered_backends`, but a backend whose tools are already registered
from the cache (Disconnected with non-empty `cached_tools`) does not force a
blocking discovery. Backends with no cache entry still do, so the
partial-cache case keeps working (`tools_list_discovers_backends_missing_
from_a_partial_cache` unchanged and passing). The refresh itself still runs in
the background and updates the list.

Measured (HTTP mode, 9 stdio backends): tools/list right after a restart went
from 5.4 s to 0.1-0.7 s.

fix: clear clippy 1.99 double_must_use

async-trait 0.1.91 stamps #[must_use] with no message onto every async
trait method. Clippy 1.99 treats that as double_must_use because the
pinned boxed future is already must_use, and CI on stable has been red
since a9ebe8f. 0.1.92 stops emitting the attribute. The future stays
must_use through its type, which is the fix the lint asks for.

Workflow actions are pinned to full commit SHAs. rust-toolchain is the
v1 commit on master, with toolchain: stable passed explicitly, because
a SHA pin does not select the stable channel the way @stable did.
Publish still uses CARGO_REGISTRY_TOKEN the same way.

Dependabot checks github-actions and cargo weekly, each in one group.

Signed-off-by: Avelino <31996+avelino@users.noreply.github.com>

how it work in mermaid

Signed-off-by: Avelino <31996+avelino@users.noreply.github.com>

Add 'mcp-session-id' to headers list

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Avelino <31996+avelino@users.noreply.github.com>

feat: add --only and --exclude to narrow the served catalog

A proxy that publishes every backend is right for a human at a terminal and
wrong for a model. Each tool costs context, and past a few hundred the client
starts hiding tools behind a lookup step, so one answer becomes several round
trips. An agent that only needs roam and github should not pay for the rest.

Both flags take comma-separated server names on mcp serve. `--only` runs first,
then `--exclude`. An unknown name gets logged as a warning instead of being
dropped quietly, because a typo would serve a catalog missing a whole backend
and that failure reads as "the model stopped using that tool".

Version goes to 0.6.2.

Signed-off-by: Avelino <31996+avelino@users.noreply.github.com>

pkg: upgrade deps

Signed-off-by: Avelino <31996+avelino@users.noreply.github.com>