Problem

ProtectedResourceMetadata.resource can be serialized with a synthetic trailing slash when a root resource URL is supplied as an already-validated AnyHttpUrl. This changes https://example.com to https://example.com/ and can break strict RFC 9728 resource matching.

Root Cause

AnyHttpUrl normalizes an empty URL path to / before ProtectedResourceMetadata's url_preserve_empty_path model setting can preserve the original spelling. The server auth settings pass an already-validated URL object into the metadata model.

Solution

Normalize only the root path in a ProtectedResourceMetadata pre-validator, removing the synthetic slash before AnyHttpUrl validation. Non-root paths and URL validation remain unchanged.

Changes

• Preserve an empty root path for ProtectedResourceMetadata.resource.
• Add regression coverage for raw metadata input and an already-normalized URL object.

Testing

• py -m pytest tests/shared/test_auth.py -q — 43 passed.
• py -m pytest tests/shared/test_auth_utils.py tests/shared/test_auth.py -q — 58 passed.
• py -m pytest tests/client/test_auth.py -q — 140 passed, 1 xfailed.
• py -m ruff format --check src/mcp/shared/auth.py tests/shared/test_auth.py — passed.
• py -m ruff check src/mcp/shared/auth.py tests/shared/test_auth.py — passed.
• git diff --check — passed.

Compatibility/Risk

The public field type remains AnyHttpUrl. Only a root-path slash synthesized by URL normalization is removed; non-root paths, query strings, and validation behavior are unchanged.

Notes for Reviewer

Pyright could not be run with the repository's configured .venv because this incremental worktree does not contain that environment. A separate available environment reported no source-file diagnostics but reported unrelated baseline test typing diagnostics; this is explicitly unverified locally.

Linked Issue

Closes #2883