[Story] Add blockedMcpServers to mode config (allowedMcpServers allowlist already implemented)

[edelauna]

Context

Per-mode MCP allowlisting is already fully implemented: `allowedMcpServers?: string[]` exists in `packages/types/src/mode.ts`, is enforced in `build-tools.ts`, `filter-tools-for-mode.ts`, `getMcpServerTools()`, and has a complete UI in `McpServerRestriction.tsx` / `McpServerChecklist.tsx`.

What's missing is the blocklist counterpart: a user who wants "everything except the `postgres` server in Code mode" today has to enumerate every other server as an allowlist, and update it every time they add a new MCP server.

Closes: RooCodeInc/Roo-Code#12004 (partial — allowlist half already done).

Developer Notes

• Add `blockedMcpServers?: string[]` to `modeConfigSchema` in `packages/types/src/mode.ts` alongside `allowedMcpServers`.
• Precedence: `allowedMcpServers` (explicit allowlist) takes priority over `blockedMcpServers`. When only `blockedMcpServers` is set, exclude those servers and allow all others.
• Apply in `src/core/prompts/tools/filter-tools-for-mode.ts` and `src/core/prompts/tools/native-tools/mcp_server.ts` (getMcpServerTools) alongside the existing `allowedMcpServers` filter.
• Apply in `src/core/prompts/sections/capabilities.ts` for the system prompt capabilities section.
• Update `McpServerRestriction.tsx` / `McpServerChecklist.tsx` to expose the blocklist alongside the existing allowlist toggle.

Acceptance Criteria

• `blockedMcpServers` field added to mode config schema and type
• Integration test: mode with `blockedMcpServers: ["postgres"]` → `postgres-*` tools excluded, all other MCP tools present
• Integration test: mode with both `allowedMcpServers` and `blockedMcpServers` set → allowlist wins
• Mode editor UI exposes the blocklist field