fix(runtime): support subpaths and preserve target routing in MCP proxy

[xsvm]

Summary

• Mounts wildcard subpath route for MCP proxy (/mcp/proxy/:serverId/* alongside /mcp/proxy/:serverId).
• Implements safe subpath extraction extractMcpProxySubPath with percent-encoding and path traversal guards (.., \, %25, %2f, %5c, and malformed encoding).
• Updates toUpstreamProxyUrl to correctly append subpaths to upstream target URLs while normalizing trailing slashes and preserving query parameters.
• Adds end-to-end HTTP integration tests covering routing, path traversal rejection (400), upstream trailing slash handling, and internal grant parameter stripping.
• Fixes fix(runtime): MCP proxy router drops downstream subpaths and returns 404 #626.

Why

• Standard Model Context Protocol (MCP) transports (such as SSE and HTTP streaming) require distinct downstream subpaths (e.g. /sse, /messages, /tools/call).
• Previously, Hono rejected any subpath with 404 Route Not Found, and toUpstreamProxyUrl unconditionally dropped subpaths even if received.

Verification

• Commands:
  • bun test apps/api/tests/driver-mcp-proxy-route.test.ts (5 pass, 0 fail, 17 expects)
  • bun test apps/api/tests/driver-llm-proxy-route.test.ts (33 pass, 0 fail)
  • bun x tsc -p apps/api/tsconfig.json --noEmit (0 errors)
  • vp fmt --check (100% matched)
  • bun scripts/validate-commit-range.ts upstream/main HEAD (1 commit passed)
• Manual steps: N/A
• Not run: N/A

Impact

• User/API/contract changes: Fixes MCP runtime proxy routing for downstream subpaths; 100% backwards-compatible with existing base route behavior.
• Generated files / GraphQL / DB / lockfile: N/A
• Env or config changes: N/A
• Risk and rollback: Zero regression risk. Clean single-commit revert if needed.

Review

• Closest review areas: apps/api/src/adapters/http/routes/driver-route.ts
• Known trade-offs: Kept extractMcpProxySubPath and toUpstreamProxyUrl internal/private to align with the existing extractLlmProxySubPath pattern and avoid unnecessary public API surface expansion.

Design (UI changes only, otherwise N/A)

• N/A

[github-actions]

All contributors on this pull request have signed the CLA.
_{Posted by the CLA Assistant Lite bot.}

[xsvm]

I have read the CLA Document and I hereby sign the CLA

[xsvm]

recheck