[Exeloo]

What does this PR do?

No linked issue (fix found during an org issue triage).

The client server now resolves request paths for /game/* and /* inside the game folder and the website folder, and answers 404 for anything outside them. The website folder is resolved with fileURLToPath, which also fixes installs whose path contains spaces.

apps/client/src/safe-path.ts   resolveInside(root, path) -> path | null
apps/client/src/server.ts      both file routes use it; webDir computed once
apps/client/test/              unit tests (new test:unit script)
docs/docs/client.mdx           one paragraph on the 404 for paths outside the folders

Note: /package.json on the client now returns 404 (it used to serve the website's package.json); the website never requests it.

How do you test this PR?

• bun test in apps/client: 5 pass, 0 fail
• pnpm lint, pnpm build, pnpm test:unit: pass (also run by the pre-push hook)
• Run the built client with a game dir (bun run dist/server.js -p <port> -d <game dir>): in-folder files, / and /index.html return 200; paths that resolve outside the game or website folder return 404.
• Not tested on Windows (no Windows host).

Merge danger

Door: two-way (revert is enough)
Blast radius: small, @nanoforge-dev/loader-client; reaches @nanoforge-dev/cli users after a loader release and a CLI bump. Nothing deploys on merge.

Quality gate

Check	Result	Notes
Docs	Updated	docs/docs/client.mdx
Correctness	Pass	1 Important fixed in 4896ad7, re-reviewed
Performance	Pass	path check is a few string operations per request; website folder resolved once at startup
Accessibility	N/A (no UI or terminal output change)
Security	Pass	2 Minor, handled privately
Style	Pass	lint: pass

Follow-up issues

None