server: a directory under /s/ answers 404, not a listing (closes #286)

http.FileServer answered /s/ and /s/css/ with an HTML listing of the
embedded files, and /s/css with a redirect to that listing. The static
handler now looks the name up in the embedded files first and answers
404 when it names a directory; files are served as before.

Model: opus-5-5

internal/server/routes.go

@@ -1,7 +1,9 @@
 package server
 
 import (
+	"io/fs"
 	"net/http"
+	"strings"
 	"time"
 
 	sentryhttp "github.com/getsentry/sentry-go/http"
@@ -47,13 +49,7 @@ func (s *Server) SetupRoutes() {
 	public.Get("/", s.handlers.HandleDashboard())
 
 	// Static assets (embedded CSS/JS)
-	public.Mount(
-		"/s",
-		http.StripPrefix(
-			"/s",
-			http.FileServer(http.FS(static.Static)),
-		),
-	)
+	public.Mount("/s", http.StripPrefix("/s", staticAssets()))
 
 	// Health check (standard well-known path)
 	public.Get(
@@ -86,3 +82,27 @@ func (s *Server) SetupRoutes() {
 		s.router.Mount("/metrics", metrics)
 	}
 }
+
+// staticAssets serves the embedded static assets, with the /s prefix
+// already stripped from the path. A request that names a directory
+// answers 404: http.FileServer would answer it with a listing of the
+// directory, or with a redirect to that listing when the trailing
+// slash is missing.
+func staticAssets() http.Handler {
+	files := http.FileServer(http.FS(static.Static))
+
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// fs.Stat refuses a name that is empty or ends in a slash,
+		// so /s/ and /s/css/ answer 404 here along with /s/css.
+		name := strings.TrimPrefix(r.URL.Path, "/")
+
+		info, err := fs.Stat(static.Static, name)
+		if err != nil || info.IsDir() {
+			http.NotFound(w, r)
+
+			return
+		}
+
+		files.ServeHTTP(w, r)
+	})
+}