fix(transport): include app_root_path in enforced OAuth audience

[C0d3N1nja97342]

🔗 Related Issue

Closes #5172

📝 Summary

_build_server_resource_url in mcpgateway/transports/streamablehttp_transport.py derives the enforced access-token aud from settings.app_domain only (f"{app_domain}/servers/{id}/mcp"), dropping app_root_path. On path-prefixed deployments (APP_ROOT_PATH set — e.g. gateway mounted under /gw behind an ingress), this diverges from the advertised Protected Resource Metadata URL, which is built via _build_public_base_url and includes scope["root_path"]:

• advertised resource: {scheme}://{host}{root_path}/servers/{id}/mcp
• enforced aud: {APP_DOMAIN}/servers/{id}/mcp ← missing root_path

So tokens minted for the advertised resource fail audience validation on path-prefixed deployments.

Fix: include settings.app_root_path between app_domain and /servers/ in the enforced audience. Backward compatible — an empty app_root_path leaves the URL unchanged.

📏 Reviewability

• This PR has one clear purpose
• The linked issue is not labeled triage — ⚠️ [BUG]: Inbound OAuth audience enforcement ignores APP_ROOT_PATH — enforced aud ≠ advertised PRM resource on path-prefixed deployments #5172 is currently labeled triage. Submitting the fix for review; happy to wait for triage removal / maintainer acceptance first if preferred.
• Unrelated bugs or improvements are tracked in separate issues/PRs
• Tests are included with the code they validate
• If AI-assisted, I understand and can explain the generated changes

🏷️ Type of Change

• Bug fix

Changes

• mcpgateway/transports/streamablehttp_transport.py: _build_server_resource_url now appends settings.app_root_path (normalized: stripped, leading / ensured) between app_domain and /servers/{id}/mcp.
• tests/unit/mcpgateway/transports/test_streamablehttp_transport.py: two tests — app_root_path="/gw" → URL includes /gw; empty app_root_path → URL unchanged.

Testing

• New tests pass: uv run pytest tests/unit/mcpgateway/transports/test_streamablehttp_transport.py -k build_server_resource_url → 2 passed.
• No regression in the OAuth audience/auth suite: uv run pytest tests/unit/mcpgateway/test_auth.py -k "resource or audience or canonical or oauth" → 111 passed.
• ruff check clean on the changed file.

Notes for Reviewer

• The fix mirrors how _build_public_base_url already includes scope["root_path"], using the operator-set settings.app_root_path (same trust anchor as app_domain, consistent with the function's existing security note).
• The fix is intentionally minimal and scoped to _build_server_resource_url (the enforced-aud path). The advertised-resource path (_build_resource_metadata_url → _build_public_base_url) already includes root_path and is unchanged.
• IBM CLA: I will sign via cla-assistant once it checks this PR.