#80 serve: static GET/HEAD buffers whole file in RAM (OOM on large raw files)

What

Static file responses buffer the whole file into memory before sending, for GET and HEAD:

• src/serve.rs:695 — std::fs::read(&dest) happens before the method check.

Raw blobs are unbounded (build streams any size to raw/), so /raw/big.bin allocates the full size per request. With MAX_CONNS=64, a handful of large files can OOM the process.

Reproduced

64 MB blob, VmHWM before/after one request:

VmHWM:  70,540 kB

(process baseline ~5 MB). HEAD performs the same read.

Impact

Remote OOM/DoS on hu13 serve; the streaming path already exists for git packs (respond_file) but is not used for static assets.

Fix

• Use respond_file (or equivalent streaming with Content-Length from stat) for static files.
• HEAD: stat only, send headers, no body.
• Keep the method check before opening/reading the file.
• Test: large raw file, assert a bounded read/streamed response and HEAD without buffering.