fix: validate static asset request hosts

[smiggleworth]

Closes #10.

Extracts the canonical Host and absolute-form target validation into a shared request URL resolver and runs it before static asset lookup as well as application dispatch.

Regression proof sends a valid asset path with a hostile Host and a cross-origin absolute-form target; both return 400 without reaching the app or serving the file. Full local npm run check passes (27 tests, lint, types, build, publint, package checks).

[Copilot]

Pull request overview

This PR closes #10 by ensuring Host and absolute-form request-target validation runs before any response path in serve(), including the static asset-serving fast path. It extracts the URL/Host validation logic into a shared resolver so both the app dispatch and static asset lookup enforce the same boundary.

Changes:

• Extracted canonical Host + absolute-form target validation into resolveNodeRequestUrl() and reused it within requestFromNode().
• Updated serve() to resolve/validate the request URL before static asset lookup (and thus before any file can be served).
• Added regression coverage verifying hostile Host and cross-origin absolute-form targets yield 400 without serving assets or reaching the app handler.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
tests/node.test.ts	Adds regressions to ensure static asset requests are rejected (400) for hostile Host and cross-origin absolute-form targets without falling through to the app.
src/serve.ts	Validates/normalizes the request URL (including Host + absolute-form origin checks) before static asset handling to prevent bypass.
src/request.ts	Extracts shared validation into resolveNodeRequestUrl() and reuses it in requestFromNode() to keep behavior consistent across entrypoints.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.