admin: fix TrimRight → TrimSuffix in provisioning path validation

strings.TrimRight strips all trailing slashes, so a configured path
like /foo// passed validation (both slashes trimmed to /foo matching
path.Clean output) but was silently broadened to /foo at runtime.

Use strings.TrimSuffix instead, which removes exactly one trailing
slash — the only form the exemption was meant to allow (users write
/pki/ca/prod/ meaning the /pki/ca/prod scope).

Also update the // test case: with TrimSuffix, // is just / + one
trailing slash, which is valid under the exemption. Add a new test
for /foo// (double trailing slashes → wantErr: true).

Co-authored-by: atlarix-agent <agent@atlarix.dev>

admin.go

@@ -560,7 +560,7 @@ func replaceRemoteAdminServer(ctx Context, cfg *Config) error {
 					continue
 				}
 				cleanPath := path.Clean(permPath)
-				if cleanPath != permPath && strings.TrimRight(permPath, "/") != cleanPath {
+				if cleanPath != permPath && strings.TrimSuffix(permPath, "/") != cleanPath {
 					return fmt.Errorf("access control %d permission %d: path %q is not canonical (did you mean %q?)", i, j, permPath, cleanPath)
 				}
 			}

admin_test.go

@@ -870,7 +870,7 @@ vq+SH04xKhtFudVBAQ==`
 			wantErr: true,
 		},
 		{
-			name: "non-canonical path //",
+			name: "root path with single trailing slash (//)",
 			cfg: &Config{
 				Admin: &AdminConfig{
 					Identity: &IdentityConfig{},
@@ -885,7 +885,7 @@ vq+SH04xKhtFudVBAQ==`
 					},
 				},
 			},
-			wantErr: true,
+			wantErr: false,
 		},
 		{
 			name: "non-canonical path /..",
@@ -923,6 +923,24 @@ vq+SH04xKhtFudVBAQ==`
 			},
 			wantErr: true,
 		},
+		{
+			name: "non-canonical path with double trailing slashes",
+			cfg: &Config{
+				Admin: &AdminConfig{
+					Identity: &IdentityConfig{},
+					Remote: &RemoteAdmin{
+						Listen: "localhost:2021",
+						AccessControl: []*AdminAccess{
+							{
+								PublicKeys:  []string{testCert},
+								Permissions: []AdminPermissions{{Methods: []string{"GET"}, Paths: []string{"/foo//"}}},
+							},
+						},
+					},
+				},
+			},
+			wantErr: true,
+		},
 	}
 
 	for _, test := range tests {