The no-ghost theorem for AdS3 and the stringy exclusion principle