Document and test that unrouted methods get 405 without Allow on /s/*

A method chi does not route, such as PROPFIND, is refused by the
top-level router before it reaches the /s group, so it gets 405
without an Allow header. The README row and the test's doc comment
now say so, and TestStaticServesOnlyGetAndHead checks PROPFIND.

Model: opus-5-5

internal/server/routes_test.go

@@ -397,9 +397,12 @@ func (e *testEnv) storedHash(t *testing.T, username string) string {
 // --- /s static group ---
 
 // TestStaticServesOnlyGetAndHead pins the methods the static group
-// answers: GET and HEAD are served the asset, and any other method
-// is refused with 405 and an Allow header naming those two. The
-// README documents this; the test is what keeps the two from
+// answers: GET and HEAD are served the asset, and the other methods
+// chi routes (POST, PUT, DELETE and the rest) are refused with 405
+// and an Allow header naming those two. A method chi does not route,
+// such as PROPFIND, is refused with 405 by the top-level router
+// before it reaches the static group, so it gets no Allow header.
+// The README documents this; the test is what keeps the two from
 // drifting.
 func TestStaticServesOnlyGetAndHead(t *testing.T) {
 	t.Parallel()
@@ -416,6 +419,7 @@ func TestStaticServesOnlyGetAndHead(t *testing.T) {
 		http.MethodPost,
 		http.MethodPut,
 		http.MethodDelete,
+		"PROPFIND",
 	} {
 		t.Run(method, func(t *testing.T) {
 			t.Parallel()
@@ -436,6 +440,17 @@ func TestStaticServesOnlyGetAndHead(t *testing.T) {
 				assert.Equal(t, http.StatusOK, w.Code)
 				assert.Empty(t, w.Body.Bytes(),
 					"HEAD must not carry a body")
+			case "PROPFIND":
+				assert.Equal(
+					t, http.StatusMethodNotAllowed, w.Code,
+				)
+				assert.Empty(t, w.Header().Get("Allow"),
+					"chi refuses a method it does not route "+
+						"before the static group runs")
+				assert.NotContains(
+					t, w.Body.String(), string(body),
+					"a refused method must not get the asset",
+				)
 			default:
 				assert.Equal(
 					t, http.StatusMethodNotAllowed, w.Code,