Return proper 404s for unmatched API routes and static files

Add a /api catch-all that returns 404 JSON for unmatched API routes.
In the SPA fallback, only serve index.html for navigation requests
(no file extension) — requests for non-existent static files now
get a real 404 instead of index.html with 200.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/index.js

@@ -44,10 +44,21 @@ app.use('/api/orders', ordersRouter);
 app.use('/api/dashboard', dashboardRouter);
 app.use('/api/reports', reportsRouter);
 
+// 404 for unmatched API routes
+app.use('/api', (req, res) => {
+  res.status(404).json({ error: 'Not found' });
+});
+
 if (process.env.NODE_ENV === 'production') {
-  app.use(express.static(path.join(__dirname, '..', 'client', 'dist')));
+  const clientDist = path.join(__dirname, '..', 'client', 'dist');
+  app.use(express.static(clientDist));
   app.get('*', (req, res) => {
-    res.sendFile(path.join(__dirname, '..', 'client', 'dist', 'index.html'));
+    // Only serve index.html for navigation requests (no file extension).
+    // Requests for non-existent static files (e.g. /foo.js) get a real 404.
+    if (path.extname(req.path)) {
+      return res.status(404).end();
+    }
+    res.sendFile(path.join(clientDist, 'index.html'));
   });
 }