refactor: use _normalize_scope_path in MCPPathRewriteMiddleware

Replace inline root_path stripping with existing _normalize_scope_path()
which provides full-segment boundary checks and root_path="/" safety.

Closes #4215

Signed-off-by: Madhav Kandukuri <madhav165@gmail.com>

Author: madhav165

mcpgateway/main.py

@@ -1434,9 +1434,7 @@ def jsonpath_modifier(data: Any, jsonpath: str = "$[*]", mappings: Optional[Dict
     # Log jsonpath_modifier invocation with structured data (only if debug enabled)
     if logger.isEnabledFor(logging.DEBUG):
         data_length = len(data) if isinstance(data, list) else None
-        logger.debug(
-            f"jsonpath_modifier: path='{SecurityValidator.sanitize_log_message(jsonpath)}', has_mappings={mappings is not None}, " f"data_type={type(data).__name__}, data_length={data_length}"
-        )
+        logger.debug(f"jsonpath_modifier: path='{SecurityValidator.sanitize_log_message(jsonpath)}', has_mappings={mappings is not None}, data_type={type(data).__name__}, data_length={data_length}")
 
     try:
         main_expr: JSONPath = _parse_jsonpath(jsonpath)
@@ -3005,15 +3003,12 @@ async def _call_streamable_http(self, scope, receive, send):
         original_path = scope.get("path", "")
         scope["modified_path"] = original_path
 
-        # Extract root_path prefix and strip it before pattern matching.
+        # Strip root_path prefix before pattern matching.
         # In reverse proxy deployments, scope["path"] may contain the full path
         # including the proxy prefix (e.g., "/dev/mcp-gateway/service/gateway/servers/123/mcp").
         # We need to strip this prefix to correctly match the /servers/ pattern.
-        # Pattern follows streamablehttp_transport.py:831 and token_scoping.py:354.
         root_path = (scope.get("root_path") or settings.app_root_path or "").rstrip("/")
-        app_path = original_path
-        if root_path and original_path.startswith(root_path + "/"):
-            app_path = original_path[len(root_path) :]
+        app_path = _normalize_scope_path(original_path, root_path)
 
         # Skip rewriting for well-known URIs (RFC 9728 OAuth metadata, etc.)
         # These paths may end with /mcp but should not be rewritten to the MCP transport