#111 serve 404.html symlink escapes www and leaks host files

Problem

serve's normal static path resolves symlinks and rejects targets outside www, but the custom 404 fallback reads www/404.html with a raw metadata/File::open and no symlink or prefix check. A symlinked 404.html can publish any host file on every unknown path.

Verified:

ln -s /etc/hostname /tmp/rev5-404www/404.html
hu13 serve --www /tmp/rev5-404www --inbox-dir /tmp/rev5-inbox --listen 127.0.0.1:39441
curl http://127.0.0.1:39441/nope
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=utf-8
reflectivity

If the symlink target is script-bearing HTML, it also executes in the inbox origin because the 404 response has no attachment disposition. src/serve.rs:913-931.

Fix

Resolve 404.html with the same resolve_existing/starts_with(www) check as normal static paths and reject symlinks (or require the resolved target under www). Add a symlinked-404 integration test.