serve the files a bundle owns

Every figure and gallery shipped so far emitted links a browser could not fetch: a
relative src resolves under the page's URL, and nothing answered there. Found by
fetching the pages' own links rather than by reading their markup — the evidence
runs had been checking that the right src appeared, never that it worked.

A directory bundle's files are now served under its URL. The bundle is looked up
first and the file is read only from the directory that bundle owns, never from a
path assembled out of the request: ADR-0024 requires that no route serve bundle
bytes by path alone, since every byte inside a bundle inherits its publish status.
When drafts arrive at queue 19 the filter belongs beside that lookup and nowhere
else, which is why the ordering is written down in the comment.

A single-file bundle owns nothing: its neighbours belong to the section, and its
slash-terminated URL has nothing beneath it. An author with assets writes a
directory bundle, now stated in content-model.md.

A .md inside a bundle directory is never an asset — it is a bundle with its own URL
or a fragment that was never addressable, and serving either raw would publish
source. http.ServeFileFS handles content type, conditional requests and ranges,
none of which is worth reimplementing here.

internal/content/content.go

@@ -147,6 +147,19 @@ func Parse(name string, data []byte) (Bundle, error) {
 	return b, nil
 }
 
+// Assets is the directory holding a bundle's own local files, and false for a bundle that has none.
+//
+// Only a directory bundle has one. A single-file bundle's neighbours belong to its section rather than to it,
+// and its URL ends in a slash that no file beside it sits under — so an author with assets writes a directory
+// bundle (content-model.md).
+func (b Bundle) Assets() (string, bool) {
+	base := path.Base(b.Path)
+	if strings.HasPrefix(base, "index.") || strings.HasPrefix(base, "_index.") {
+		return path.Dir(b.Path), true
+	}
+	return "", false
+}
+
 // stringList reads a YAML scalar or sequence of strings as keys: normalised, without surrounding
 // slashes. Anything that is not a string is ignored rather than failing the bundle.
 func stringList(v any) []string {