fix: validate explicit migrations and preserve large business ids

internal/utils/routepath/routepath.go

@@ -5,10 +5,13 @@ import "strings"
 // Normalize removes only a complete configured router prefix. Paths
 // such as /administrator must not be shortened when the prefix is /admin.
 func Normalize(path, routerPrefix string) string {
-	prefix := strings.TrimSuffix(strings.TrimSpace(routerPrefix), "/")
-	if prefix == "" || prefix == "/" {
+	prefix := strings.Trim(strings.TrimSpace(routerPrefix), "/")
+	if prefix == "" {
 		return path
 	}
+	// Gin also accepts a relative group name such as "api". Normalize it
+	// the same way before comparing a request path with Casbin policies.
+	prefix = "/" + prefix
 	if path == prefix {
 		return "/"
 	}