Add tests for the /packs static file and SQLite download handler

[DeleMike]

Terms

• I have searched open and closed feature requests
• I agree to follow Scribe-Server's Code of Conduct

Description

• Tests for setupStaticFiles in api/server.go, the most security-sensitive untested code in the repo.
• Covers the listing endpoint, download headers, 400/404 paths, encoded and double-encoded traversal attempts, and clean startup when the packs directory is absent.
• We should prevent any arbitrary file read.

Contribution

No response