fix: let dynamic routes bypass static assets

[smiggleworth]

Summary

• add an assets.exclude(pathname) escape hatch for dotted application routes
• preserve encoded request URLs while matching exclusions against decoded pathnames
• share server content-type normalization when available, with compatibility for the current 0.2.0 server surface
• document and stress-test mixed dynamic/static concurrency
• cover malformed/oversized raw HTTP input and in-flight shutdown

Verification

• npm run check
• 3 test files / 62 tests
• lint, typecheck, build, publint, and package-artifact checks passed

No package versions or dependency ranges changed. No publish or release workflow was invoked.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.