fix(journal): don't crash the process on a malformed request URL

A request for path `//` (also `///`, `/\`, ...) makes `new URL(req.url,
base)` throw ERR_INVALID_URL. serveStatic runs synchronously inside the
createServer callback, so the throw is an uncaught exception that kills
the process. Docker (`unless-stopped`) restarts it, and a client looping
on `//` crash-loops the journal — a trivial unauthenticated DoS. This
fired the "Container restart loop" Grafana alert in production (journal
restarted ~10x in 6 minutes).

Guard the URL parse with try/catch and fall through to the React Router
handler, which 404s malformed paths cleanly (the same way it already
handles scanner probes like /root/.ssh/id_rsa).

Extract serveStatic into its own module so it can be unit-tested without
booting the HTTP server, and add a regression test covering the
malformed-path cases. Widen the journal vitest include to discover
co-located tests for root-level server infra.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/journal/vitest.config.ts

@@ -3,6 +3,13 @@ import shared from "../../vitest.shared.ts";
 import { resolve } from "node:path";
 
 export default mergeConfig(shared, defineConfig({
+  test: {
+    // mergeConfig concatenates arrays, so this adds to the shared
+    // include globs rather than replacing them. Picks up co-located
+    // tests for root-level server infra (server.ts, serve-static.ts)
+    // that live outside app/ and src/.
+    include: ["*.test.{ts,tsx}"],
+  },
   resolve: {
     alias: {
       "~": resolve(import.meta.dirname, "app"),