serve the files a bundle owns

Every figure and gallery shipped so far emitted links a browser could not fetch: a
relative src resolves under the page's URL, and nothing answered there. Found by
fetching the pages' own links rather than by reading their markup — the evidence
runs had been checking that the right src appeared, never that it worked.

A directory bundle's files are now served under its URL. The bundle is looked up
first and the file is read only from the directory that bundle owns, never from a
path assembled out of the request: ADR-0024 requires that no route serve bundle
bytes by path alone, since every byte inside a bundle inherits its publish status.
When drafts arrive at queue 19 the filter belongs beside that lookup and nowhere
else, which is why the ordering is written down in the comment.

A single-file bundle owns nothing: its neighbours belong to the section, and its
slash-terminated URL has nothing beneath it. An author with assets writes a
directory bundle, now stated in content-model.md.

A .md inside a bundle directory is never an asset — it is a bundle with its own URL
or a fragment that was never addressable, and serving either raw would publish
source. http.ServeFileFS handles content type, conditional requests and ranges,
none of which is worth reimplementing here.

internal/web/web.go

@@ -18,7 +18,7 @@ import (
 func Handler(site *content.Site, r *render.Renderer, siteFS fs.FS, settings content.Settings) http.Handler {
 	mux := http.NewServeMux()
 	mux.HandleFunc("GET /", func(w http.ResponseWriter, req *http.Request) {
-		serve(w, req, site, r)
+		serve(w, req, site, r, siteFS)
 	})
 	// Two exact paths a crawler asks for by name, so they are mux entries rather than resolver cases: no
 	// bundle can own them, since a key always sits under a section.
@@ -122,7 +122,7 @@ func writeAs(w http.ResponseWriter, contentType string, out []byte, what string)
 }
 
 // serve resolves one request and writes its bundle.
-func serve(w http.ResponseWriter, req *http.Request, site *content.Site, r *render.Renderer) {
+func serve(w http.ResponseWriter, req *http.Request, site *content.Site, r *render.Renderer, siteFS fs.FS) {
 	res, ok := resolve(req.URL.Path, site)
 	if !ok {
 		http.NotFound(w, req)
@@ -151,6 +151,10 @@ func serve(w http.ResponseWriter, req *http.Request, site *content.Site, r *rend
 			http.Redirect(w, req, content.URL(site.RouteOf(canonical), res.lang), http.StatusMovedPermanently)
 			return
 		}
+		// A file inside a bundle's directory: how a relative src in a body resolves (ADR-0024).
+		if serveAsset(w, req, site, siteFS, res) {
+			return
+		}
 		if serveListing(w, req, site, r, res) {
 			return
 		}