Maybe url joining should be done in more robust way instead of naive string concatenation?

Like

package main

import (
	"fmt"
	"net/url"
	"os"
)

func main() {
	u, err := url.JoinPath("/api/tus", "bar/")
	if err != nil {
		os.Exit(1)
	}
	fmt.Println(u)
}

This will give correct results regardless of leading slash presence or absence in joining value.

That's true, but I don't see the need since r.URL.Path is guaranteed to be the same as the URL, stripped of the /api/tus, since that's the path matcher for this HTTP route.