fix: constrain the chapter catch-all route to the slug alphabet

Chapter slugs come from name.parameterize, which produces lowercase
letters, digits, hyphens, and underscores (parameterize preserves
underscores via its gsub). Constraining the catch-all (:id =>
'chapter#show') to that alphabet makes paths with dots, uppercase, or
other characters 404 at the router instead of reaching
ChapterController and the database. format: false stops Rails from
consuming a trailing .pem as an optional format segment.

Most of this traffic is scanner junk: on 2026-09-16, 91% of the 4,218
ChapterController requests were 404s, mostly sensitive-file probes.
Underscore paths still route and 404 in-app with the branded page.

Production slug audit (2026-09-19): 54 chapters, 0 slugs outside
[a-z0-9_-]+.

Closes #2891

Author: mroderick

config/routes.rb

@@ -201,7 +201,7 @@
   get 'donate' => 'pages#show', id: 'donate'
   get 'codebar-stories-podcast' => 'pages#show', id: 'codebar-stories-podcast'
 
-  get ':id' => 'chapter#show', as: :chapter
+  get ':id' => 'chapter#show', as: :chapter, format: false, constraints: { id: /[a-z0-9_-]+/ }
 
   # Redirects
   get '/my/jobs/new', to: redirect('https://jobs.codebar.io/my/jobs/new')

spec/routing/chapter_routing_spec.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe 'chapter catch-all route' do
+  it 'routes a chapter slug to chapter#show' do
+    expect(get: '/london').to route_to(controller: 'chapter', action: 'show', id: 'london')
+  end
+
+  # Chapter#set_slug builds slugs with name.parameterize, which produces
+  # lowercase letters, digits, hyphens, and underscores.
+  it 'routes every character class the slug generator can produce' do
+    expect(get: '/123').to route_to(controller: 'chapter', action: 'show', id: '123')
+    expect(get: '/south-london').to route_to(controller: 'chapter', action: 'show', id: 'south-london')
+    expect(get: '/spring_wildcats').to route_to(controller: 'chapter', action: 'show', id: 'spring_wildcats')
+  end
+
+  it 'does not route paths containing dots' do
+    expect(get: '/key.pem').not_to be_routable
+  end
+
+  it 'does not route paths containing uppercase characters' do
+    expect(get: '/Shanghai').not_to be_routable
+  end
+end