Add router tests for /assets/ access control

[Copilot]

The new conditional /assets/ routing (public when PublicAccess/AuthDisabled, auth-required otherwise) lacked test coverage for the static file route itself.

Changes

• Test helper: uploadTestAsset() creates page, uploads asset, handles auth/CSRF tokens
• Test scenarios:
  • Private mode + no auth → 401
  • Private mode + auth → 200
  • Public access + no auth → 200
  • Auth disabled + no auth → 200

Each test verifies both status code and file content to ensure the routing logic in router.go:61-72 prevents unauthorized access regressions.

// Upload asset with auth, verify unauthenticated access fails
assetURL, _ := uploadTestAsset(t, router, w, "content", true)
req := httptest.NewRequest(http.MethodGet, assetURL, nil)
rec := httptest.NewRecorder()
router.ServeHTTP(rec, req)
assert.Equal(t, http.StatusUnauthorized, rec.Code)

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.