### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

Through static code analysis of the MCP server routing logic in proxy_server.py, two potential architectural flaws were identified that could lead to unexpected routing behaviors or context mismanagement:

1. Improper Input Validation in Fallback Routing: The routing logic uses mcp_server_name to match a Toolset first, and falls back to an Access Group. If mcp_server_name is constructed with unsanitized input (e.g., containing path traversal sequences like ../ or arbitrary URI schemes), and it reaches _mcp_forward_as_path, it may result in Server-Side Request Forgery (SSRF) or unauthorized internal endpoint access.

2. ContextVar Lifecycle Risk in Streaming: The _mcp_active_toolset_id (a ContextVar) is reset inside a finally block immediately after await _stream_mcp_asgi_response(...). In certain asynchronous streaming patterns (where background generators yield chunks lazily after the main coroutine returns), resetting the context token prematurely can lead to context loss or cross-request pollution during concurrent requests.

### Steps to Re…