fix(spa): missing static assets return index.html with 200 instead of 404 #310

What

spa_handler (crates/trapfalld/src/spa.rs) falls back to serving index.html (200, text/html) for any unmatched path — including /_app/immutable/entry/start.*.js and other extension-bearing asset URLs.

Why it's a problem

• Masks missing-asset breakage completely (this is how the blank-dashboard bug bug(ui): dashboard renders blank on fresh clone — web/build assets not in git but embedded at compile time #307 hid so well): the browser gets HTML instead of JS, fails parsing, and the page is blank with no network-level error signal.
• Wrong Content-Type + 200 for nonexistent .js/.css files poisons debugging and any future CDN/caching layer.

Suggested fix

If the path looks like a static asset (has a file extension, or starts with _app/, favicon, robots), return 404 when Assets::get() misses. Only fall back to index.html for extension-less SPA routes.