### Check for existing issues

- [ ] I have searched the existing issues and checked that my issue is not a duplicate.

### The Feature

Add a way to exclude specific MCP servers from a request instead of only being able to include them. Today `x-mcp-servers` (and MCP access groups) only support an allowlist — you list the servers you want, everything else is dropped.

Concretely: a header like `x-mcp-exclude-servers: server_a,server_b` (or an equivalent proxy config option) that removes the named servers from the aggregated session, keeping everything else the caller is otherwise allowed to see.

### Motivation, pitch

I aggregate several MCP servers behind the gateway. One of them exposes an MCP-Apps UI resource. `resources/read` on that resource only works when it's the *sole* server in the session (`len(allowed_mcp_servers) != 1` → 400 "Multiple MCP servers configured"). My workaround is building the include list by hand per call — fine with a handful of servers, but it doesn't scale as more get added, and I have to remember to leave the UI one out every time I want the others.

Related: #34906 (separate issue — that one is the `resources/read` bug itself; this request stands o…