Source stylesheets are still served at their own URLs, diverging from the bundle

[vitorbaptista]

What

Since #190 the pages link only their generated bundle (/stylesheet/<page>.bundle.css?v=<hash>), but the six source stylesheets are still embedded in StaticAssets and therefore still served by the serve_static fallback at their own URLs:

URL	status	bytes
/stylesheet/room.css	200	10586
/stylesheet/index.css	200	4409
/stylesheet/base.css	200	1157
/stylesheet/vendor/xterm.css	200	5559
/stylesheet/vendor/cssreset.css	200	1525
/stylesheet/vendor/cssbase.css	200	1864

~25 KB across six URLs that nothing references.

Why it matters

They are embedded because inline_css reads them from StaticAssets at boot to build the bundle — being served is an accident of living under public/. This predates #190, but #190 changed what they are: they used to be a duplicate of what the page inlined, and are now a second, divergent artifact.

The divergence is concrete. version_asset_urls runs over the bundle and the HTML, not over raw static files, so:

GET /stylesheet/room.css   ->  src: url('/font/Inconsolata.woff2')
GET /stylesheet/room.bundle.css?v=...  ->  src: url('/font/Inconsolata.woff2?v=9cee11b4bac58941')

Anything that loads the source sheet gets the unversioned font on the one-day TTL instead of the immutable one — and a second copy of a font the room page already preloads. @import "base.css" is also unresolved, though it does resolve correctly against /stylesheet/ if fetched directly, so that part is chained requests rather than breakage.

Nothing is broken today; this is dead surface that can only drift.

Suggested fix

Two options.

A. Move the source CSS out of public/ into templates/, and have inline_css read from Templates. This mirrors a precedent already documented in pages.rs for templates/agent.mjs:

Deliberately not in public/, which would serve it as a third copy at its own URL: whoever is reading already has it.

Same reasoning, same shape. The generated bundle becomes the only served representation, and the "why isn't this in public/?" question already has an answer in the codebase. version_asset_urls is unaffected (it only iterates the javascript/ and font/ prefixes).

B. 404 non-bundle paths under /stylesheet/ in serve_static. Smaller diff, but leaves files in public/ that are deliberately not served, which is the confusing state option A avoids.

Recommend A.

Acceptance

• GET /stylesheet/room.css (and the other five) returns 404.
• GET /stylesheet/room.bundle.css?v=<hash> is unchanged: same bytes, same ETag, still immutable.
• Boot assertions in render_page still fire on a missing/renamed sheet.
• e2e green, plus a case pinning that the only reachable stylesheet is the bundle.