Not able to customize the url '.well-known/oauth-protected-resource' behind AKS/nginx ingress

Describe the bug
When we enable OAuth (using Entra) for the MCP server it produces the well known resource url through '/.well-known/oauth-protected-resource'.

.AddMcp(options =>
{
    var metadata = new ModelContextProtocol.Authentication.ProtectedResourceMetadata()
    {
        Resource = new Uri(serverAddress + "api/mcp"),
        AuthorizationServers = { new Uri($"{instance}/{tenantId}/v2.0") },
        ScopesSupported = [$"{apiAppName}/Mcp.Access"],
    };

    options.ResourceMetadata = metadata;
});
...
...
app.MapMcp("/api/mcp").RequireAuthorization();

Now when we deploy this behind an ingress controller with path redirects, the MCP client doesn't have a way to know the modified resource url that it needs to connect.

E.g. if I deploy the server from this base route 'https://abc.azure.com/sanjayd' with ingress redirects, we can ideally reach the mcp server at 'https://abc.azure.com/sanjayd/api/mcp', and that will throw 401. But all clients including VS Code etc. now tries to connect to 'https://abc.azure.com/.well-known/oauth-protected-resource' to download the metadata. Ideally there should be a way to mention the base route for metadata while using ingress.

1st call from client: POST https://abc.azure.com/sanjayd/api/mcp -> returns 401 with 'www-authenticate' header like 'Bearer realm="McpAuth", resource_metadata="http://10.10.1.40/.well-known/oauth-protected-resource"'

2nd call from client: GET https://abc.azure.com/.well-known/oauth-protected-resource -> missing the 'sanjayd' part.

This works locally though as there is no ingress/re-route.

Any help is appreciated on how this will work with ingress.

Below are from a web client

AddMcp ResourceMetadata 構成と app.MapMcp("/api/mcp") エントリポイントから始め、AKS/nginx の ingress パスの背後にデプロイされたときに WWW-Authenticate の resource_metadata URL がどのように生成されるかを追跡します。/sanjayd/api/mcp フローを再現し、クライアントがベースルートを維持したままメタデータを取得できることを確認します。