fix(auth): normalize mounted request paths

[RaresKeY]

Summary

This replaces #5678, which GitHub closed during the repository transfer and fork-network separation. The branch has been rebuilt on the current dev history; the implementation scope is unchanged.

Normalize the path used by authentication middleware to the same application-relative form Starlette uses for route matching. This keeps setup, public-route exemptions, API error responses, and protected routes consistent when Odysseus is mounted below a non-empty ASGI root_path; it also makes login redirects mount-aware and limits the static exemption to the actual /static route family.

Target branch

• This PR targets dev, not main.

Linked Issue

Fixes #5677

Part of #5674

Type of Change

• Bug fix (non-breaking — fixes a confirmed issue)
• New feature (non-breaking — adds new behaviour)
• Breaking change (changes or removes existing behaviour)
• Refactor / cleanup (behaviour unchanged)
• Documentation only
• CI / tooling / configuration

Checklist

• I searched open issues and open PRs — this is not a duplicate.
• This PR targets dev.
• My changes are limited to the mounted-path authentication boundary and its regressions.
• I ran the full app interactively. This remains a draft until maintainer review and deployment-level verification are complete.

How to Test

1. Run python -m pytest -q tests/test_auth_root_path.py tests/test_cors_preflight.py tests/test_webhook_trigger_auth_exempt.py tests/test_auth_policy.py tests/test_auth_regressions.py in the repository environment. The focused suite passes with 46 tests.
2. Start Odysseus below a non-empty ASGI root path and confirm the setup/auth routes remain reachable through the mount prefix.
3. Without a session, confirm a mounted protected API route returns JSON 401, a protected browser route redirects to the mount-aware login URL, and path-token webhooks still reach their own credential check.

The exact-head full isolated suite completes with 4677 passing and 5 skipped tests. Its 12 failures exactly match the clean current-dev runner baseline: the omitted .env.example, one offline URL-join check, two backup-recovery checks, and eight offline web-fetch checks. This branch does not touch those areas.

Visual / UI changes — REQUIRED if you touched anything that renders

Not applicable. This changes middleware path handling and tests only; no rendered UI files are touched.