fix: malformed stream path escape returns routing, not a 500

[charan-rathore]

What this changes

streamPathBotId ran decodeURIComponent on the :id segment of /api/computers/:id/stream. A malformed percent-escape such as /api/computers/%zz/stream throws a URIError that escaped the Bun fetch handler, so one bad URL became a 500.

The function now returns null on a malformed escape, so normal routing answers the request. Valid ids decode as before. To unit test it I moved it into server/src/computer/stream-path.ts, because it lived inline in server/src/index.ts, which calls serve() at module scope. No issue was filed.

Where it runs

• New state that outlives a request: none. It is a pure function over the request path.
• Second replica: each process decodes the same path the same way.
• Anything serialised: none.
• Browser fan-out: none.
• New listener, port, or schedule: none.

Boundary and audit

• Acting calls: none added; gateway behavior unchanged.
• Refusals/failures: a malformed id no longer crashes the handler and now falls through to existing routing. No new refusal path.
• Client trust: none added.

Changelog

• Added an Unreleased note.

Proof

• New server/tests/computer-stream-path.test.ts (plain id, percent-encoded id, %zz and %E2%28 return null, non-matching paths return null): 4 pass, 7 assertions, real bun test run.
• The original inline function throws URIError on %zz (checked directly).
• bun build server/src/index.ts passes.
• Not run: full bun run test:ci and the repo-wide typecheck run out of memory in my container, so CI is the real check. 16 app-side packages also failed to install under disk pressure; the server test suite that covers this change ran and passed.

[charan-rathore]

Refreshed onto latest main. The CHANGELOG conflict and an import conflict in server/src/index.ts are resolved. I re-ran only the changed test file locally (server/tests/computer-stream-path.test.ts, 4 pass); CI will cover the rest.

[davidmckayv]

The current head 9bd7395 matches the accepted source disposition from the refreshed triage. Required CI must pass before landing.