harden(handlers): route every path-taking handler through McpPathValidator

harden(handlers): route every path-taking handler through McpPathValidator #1148