fix: make the server tests hermetic

They read from public/, which does not exist on a clean checkout — CI runs
bun test before any build, so the four of them failed there while passing
locally against stale build output.

serve.ts now takes PUBLIC_DIR, and the tests serve a temporary tree they
create themselves. They exercise serve.ts rather than the build, which is
what they were always meant to do.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

serve.ts

@@ -10,7 +10,8 @@
 import { resolve } from "node:path";
 
 const PORT = Number(process.env.PORT ?? 3000);
-const ROOT = "public";
+/** Overridable so tests can point at a fixture tree instead of the build. */
+const ROOT = process.env.PUBLIC_DIR ?? "public";
 const ROOT_DIR = resolve(ROOT);
 
 /** Long-lived for fingerprint-free assets is wrong; keep it short and revalidate. */