url.JoinPath percent-encodes "?", split path and query before joining or queries break

Go's net/url.JoinPath treats every input as a path segment, so passing "/auth/logout?all_devices=true" produces "/api/v1/auth/logout%3Fall_devices=true" with the question mark URL-encoded into the path. The HTTP server then sees no query string. Symmetrically, parsing the input via url.Parse and reading .Path decodes pre-escaped segments (e.g. %2F becomes /), losing url.PathEscape output you may have inserted upstream. Verified May 2026 with Go 1.26 stdlib.

When porting concat-style URL builders to url.JoinPath, split path and query with strings.Cut(path, "?") first. Run url.JoinPath only on the path side, then parse the result and assign the raw query verbatim to .RawQuery. Verify with a test that includes both a query string and a pre-escaped path segment (url.PathEscape output containing %2F).