fix: restrict Express static middleware to known public directories

[vp916]

Related Issue

Closes #1032
Closes #1030
Closes #388

(These three issues are duplicates of each other, same root cause.)

Summary

app.use(express.static(__dirname)) served the entire project root as static files, meaning anyone could directly request internal files over HTTP - e.g. /server.js, /database.js, /package.json - exposing backend source code and configuration.

Changes Made

• Removed the root-wide express.static(__dirname) mount.
• Added explicit static mounts only for the directories the frontend actually serves assets from: /css, /js, /public, /support-page.
• Added explicit routes for the two root-level files the frontend references directly: /logo.png and / (index.html).

Testing

Ran a minimal Express instance with the new route configuration and verified via curl:

• /, /logo.png, /css/index.css, /public/favicon.ico, /support-page/support.html -> 200 (all real frontend assets still served correctly)
• /server.js, /database.js, /package.json -> 404 (previously these returned 200, exposing source/config)

Screenshots

N/A (backend-only change, no UI impact).

Checklist

• Code follows project style
• Tested locally
• No unrelated changes included
• Documentation updated (if applicable)