fix: preserve a req.url rewritten inside a mounted layer

[bilashcse]

Fixes the req.url rewriting bug reported in expressjs/express#4059.

Problem

When a layer mounted with a path is entered and there is nothing left of the path, the router injects a leading slash so that req.url is never an empty string. On the way back out that slash was removed unconditionally, even when the layer had replaced req.url in the meantime, so the mount path was restored without a separator:

const router = new Router()

router.use('/foo', function (req, res, next) {
  req.url = '/bar'
  next()
})

router.use(function (req, res) {
  res.end(req.url) // => '/foobar', expected '/foo/bar'
})

GET /foo (no trailing slash) is the trigger; with GET /foo/ there is nothing to strip and the rewrite works as expected. This is what breaks rewriting middleware such as connect-history-api-fallback when it is mounted on a path.

Fix

Remember the exact url the injected slash produced and only strip it again when the layer left req.url untouched. Comparing against the stored value rather than against '/' also keeps it correct when a query string is present, since the injected value is then '/?...' rather than '/'.

Tests

Two regression tests under .use(path, ...fn) > req.url, one plain and one where the original url carried a query string. The existing strip/restore tests are untouched.

Docs

Added a note to the router.use([path], ...middleware) section: the stripped path is added back when the middleware calls next(), and a rewritten req.url is treated as relative to the mount path.

[bilashcse]

CI here is waiting on maintainer approval, so I ran the ci workflow on my fork against this branch: all 7 Test - Node.js 18..24 jobs are green. The only red job is coverage, which fails on forks because the Coveralls repo token is not available, and is unrelated to this change.

[kilisamemarisaaa]

Reviewed commit 1b53c8a.\n\nI found no blocking issues in the changed behavior. Locally on Windows with Node v24.12.0:\n-
pm test: 696 passing\n-
pm run lint: passed\n- exercised untouched /foo, /foo?x=1, rewritten /bar, query-only rewrites, and nested mounted routers; the injected slash is removed only when the middleware leaves the synthetic URL unchanged, and rewritten paths retain the mount separator as intended.\n\nThe two regression tests also cover the reported no-trailing-slash case with and without an original query string.