#8135 fix(web): answer preflights and encoded paths for moved static assets

Summary

Intent: follow-up to #8134 review. The static.anarlog.so redirect for moved screenshots answered CORS preflights with a 301, which browsers won't follow. It also missed percent-encoded spellings of an old path (e.g. free%2D11.webp), which servePublicAsset decodes. Only GET/HEAD now redirect, so preflights still get a 204, and the path is decoded before the lookup.

Demo

N/A: edge cases of the Worker redirect, covered by tests.

Verification

• node --test src/cloudflare/static-assets.test.ts (encoded path → 301, OPTIONS → 204)
• pnpm -F @anlg/web typecheck, pnpm -F @anlg/web test (378 pass)
• dprint check

---

Summary by cubic

Fixes two edge cases in the moved static asset redirect: browsers refuse to follow a 301 on a CORS preflight, and percent-encoded spellings of old paths were previously missed.

• Only GET/HEAD requests now redirect, so OPTIONS preflights keep getting a 204 response.
• The path is percent-decoded before the moved-asset lookup, matching how servePublicAsset reads paths.