Summary

• serialize ProtectedResourceMetadata.resource without a synthetic trailing slash when the resource is the origin root
• keep the internal field typed as AnyHttpUrl, so this only changes the served PRM wire shape
• add regression coverage for the root metadata endpoint and direct JSON serialization

Testing

• uv run pytest tests/server/auth/test_protected_resource.py
• uv run pytest tests/interaction/auth/test_discovery.py -k prm_endpoint_serves_the_resource_url

Fixes #2883.