fix: actually strip stale SESSION_SECRET mentions from README

The gap-g-readme merge commit (57a8914) staged this fix but never
re-staged it after editing, so the merge landed with the pre-fix content —
the working tree had the correction but git didn't. No functional change,
just closing the gap between what was intended and what was committed.

backend/app/main.py

@@ -86,4 +86,17 @@ async def serve_spa(full_path: str):
             status_code=503,
             detail="Frontend not built. Run `npm run build` in frontend/ and restart.",
         )
+
+    # Vite emits root-level static files (favicon.ico, favicon.svg,
+    # apple-touch-icon.png, og-image.png, …) straight into dist/ rather than
+    # dist/assets/ — the only mounted static dir. Without this, requests for
+    # them fall through to the SPA fallback below and get index.html back
+    # instead of the actual file (browsers silently ignore it; social-media
+    # link-preview crawlers fetching og:image get an HTML page).
+    if full_path:
+        dist_root = FRONTEND_DIST.resolve()
+        candidate = (dist_root / full_path).resolve()
+        if candidate.is_file() and dist_root in candidate.parents:
+            return FileResponse(candidate)
+
     return FileResponse(index_file)