Apply fixes from three rounds of dual review (Claude subagent + Codex):

_normalized_route.py
- _FLASK_PARAM_REGEX: change [^>:]+ to [^>]+ so converter arguments
  containing `:` (e.g. custom <regex("[a:b]+"): slug>) are handled via
  backtracking rather than stopping at the first `:`. Add clarifying comment.
- _normalize_route_flask_slow: document why non-terminal <path:...> segments
  return None — Werkzeug allows them at runtime but RFC-1103 rule 5 mandates
  catch-alls be terminal; omit-rather-than-guess is the safe contract.
- Add comment on catch-all-wins-segment behaviour for mixed path+non-path
  params (Werkzeug rejects these at registration, so unreachable in practice).

_handlers.py
- Import FLASK_RESOURCE_FULL from ddtrace.internal.constants instead of
  duplicating the string literal; removes the private _FLASK_RESOURCE_FULL_TAG
  alias so the constant is used directly at the call site.

test_normalized_route.py
- Move normalize_route_flask import to file top; remove noqa E402.
- Add assert normalize_route_flask(route) == expected to fast-path test so
  the public entry-point wiring is covered, not just the cached helper.
- Add test cases: param named <path> (no converter, not a catch-all),
  custom converter with : in argument string.
- Add test_normalize_route_flask_dm_assembly_via_handler: isolated unit test
  for the handler-level FLASK_RESOURCE_FULL assembly logic via mocks; use the
  imported FLASK_RESOURCE_FULL constant rather than a bare string literal.
- Document why /<path:tail>/and-after returns None (RFC-1103 design choice,
  not a Werkzeug constraint).

utils.py
- Add /multi-param/john.doe (no trailing slash) to test_normalized_route
  parametrize to cover the non-trailing-slash route registration.
- Document why Flask is kept in xfail for the request_span_name-override
  test (Flask middleware uses a fixed _request_call_name class attribute).

Co-Authored-By: Claude Sonnet 4.6 (1M context) <[email protected]>

Three distinct CI failures on the PR:

1. Django/FastAPI appsec_threats tests: `test_normalized_route` was
   parametrized with `/multi-param/john.doe` (no trailing slash) added
   in a prior review cycle. Django and FastAPI only register the
   trailing-slash variant of that route, causing HTTP 301/308 redirects
   and assertion failures. Remove the no-trailing-slash case from the
   shared parametrize — the trailing-slash variant already exercises
   Flask multi-param normalization end-to-end, and unit tests in
   test_normalized_route.py cover both shapes.

2. Flask appsec_threats endpoint_discovery test: `endpoint_path_to_uri`
   only substituted `<int:name>` and `<str:name>` patterns. The new
   `/multi-param/<first>.<last>/` route uses bare `<name>` converters
   (no type prefix), causing the raw pattern to be used as the request
   URI, which returns 308 (redirect to trailing-slash variant). Add
   substitution rules for bare `<name>` and `<path:name>` catch-all,
   and add the two new routes to ENDPOINT_DISCOVERY_EXPECTED_PATHS.

3. Flask contrib snapshot tests: Flask now emits `_dd.appsec.normalized_route`
   for matched routes when API Security is active. The appsec snapshot
   tests (processexec_*, userblock_*) run with DD_APPSEC_ENABLED=true
   and reach matched routes, so the new tag now appears in received
   spans. Update all 12 affected snapshot files (both `_220` and legacy
   variants). The ipblock tests are not affected because they are
   blocked before route matching and do not emit the tag.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <[email protected]>

Two remaining failures after the previous fix:

1. Snapshot JSON trailing comma: `fmt-snapshots` introduced a trailing
   comma in the `meta` object of two `test_flask_processexec_osspawn`
   snapshot files, causing a `400: Illegal trailing comma before end of
   object` parse error in the test agent. Strip the trailing comma.

2. Endpoint discovery 308 redirect: registering both `/multi-param/<first>.<last>/`
   (trailing slash) and `/multi-param/<first>.<last>` (no trailing slash)
   causes the endpoint collection to discover both paths. `endpoint_path_to_uri`
   converts the bare `<name>` converters to `test`, yielding
   `/multi-param/test.test`, which Werkzeug redirects (308) to the
   trailing-slash variant — failing the 200/401 assertion.
   Remove the no-trailing-slash multi-param route from the Flask test apps
   (only the trailing-slash variant is needed for normalisation coverage).

Co-Authored-By: Claude Sonnet 4.6 (1M context) <[email protected]>

- Remove duplicate module-level DM comment from _handlers.py (covered by inline)
- Shorten multi-line comments in _handlers.py and _normalized_route.py to one-liners
- Add ("/files/<path>", "/files/{path}") to test_normalize_route_flask_fast_path
  to document that a param named "path" (no converter) takes the fast path,
  distinct from <path:name> which is the catch-all converter

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>