Serve static assets

The notes stylesheet lives under /assets/, uses a resolved directory path, and receives a deliberate cache policy. This is a small part of an Express 5 notes application with an HTML interface, a JSON API, sessions, tests, and production failure handling, but the boundary it creates affects everything that follows.

Static middleware maps a URL prefix to a filesystem directory before later dynamic routes run. The useful target is not encyclopedic coverage. Make one deliberate choice, observe its consequences, and know which requirement would make you revise it.

Watch for one shortcut in particular: trying to serve the repository root or depend on the current working directory accidentally. It makes later failures harder to locate. Instead, mount the smallest public directory, resolve its path explicitly, and test missing files and caching headers. Prefer an implementation you can explain from the outside before optimizing it.

Keep the wider goal in view: Start a small Express 5 application whose configuration and request path can be explained from the first byte. A short observation with concrete evidence is more useful than a confident sentence with no reproduction path.

Request a known asset, a missing asset, and a private source file; only the intended public file should succeed. Hand the result to someone else and see whether the behavior is clear without an oral explanation.