Island JS 404: astroFn handler never serves dist-lambda/client static assets

**Live-verified Done** - fade5d7 merged (ff) + fresh-build deployed - /app/_astro/KanbanBoard.js -> 200, application/javascript, immutable cache - Islands hydrate (7/page); anon mutation still 403; all routes 200

**Pushed** - Branch `fix/astro-static-assets` off `main` (0b46a31), commit `fade5d7`. - No cdk synth/deploy done (controller call). - Ready for PR.

**GREEN + gates** - `web/src/lambda/staticAssets.ts`: pure `serveStaticAsset(method, rawPath, clientDir, fs)` — tries static-asset serve BEFORE Astro delegation; path-traversal safe (resolve+prefix check); binary-safe (base64+isBase64Encoded); immutable cache-control on all served assets; 404s a recognized-extension miss without delegating; `null` for everything else (SSR routes, non-/app, non-GET/HEAD). - Wired into `handler.ts` (tried first, falls through to existing Astro middleware handler on `null`). - 14 tests, all vitest + coverage green (200/200 tests, 100/100/100/100 ratchet holds). - `pnpm run typecheck` clean, `npx astro check` clean (0 errors). - `check-astro-ssr-bundle.sh` green — real rebuild confirms `dist-lambda/client/_astro/*.js` lands. - Real end-to-end smoke against the built `dist-lambda/handler.mjs`: GET a real hashed island JS file -> 200 real bytes + correct content-type + immutable cache-control; missing asset -> 404. Fix verified against actual production code path, not just unit tests.

**RED written** - New `web/src/lambda/staticAssets.ts` test suite (13 cases) fails on missing module — confirmed RED via `vitest run`. - Covers: js/css/svg/woff2 content-type + immutable cache-control, binary base64 round-trip, favicon-style non-_astro statics, HEAD, 404-without-delegate on missing recognized-extension asset, delegate-to-Astro (null) on SSR routes/`/app` root/POST/outside-mount/path-traversal. - Next: implement `serveStaticAsset` + wire into `handler.ts`.