[djthorpe]

RunServer registers RegisterCatchAll(prefix), which only matched /api exactly. An unknown path beneath it, such as /api/unknown, fell through to whatever handled /. When a server serves a UI at / with a file server, that's a plain-text 404 instead of the API's JSON error.

• The fix: RegisterCatchAll(path) now also registers the subtree beneath the path (/api/), so every unknown path under the API prefix gets a JSON 404. / is still every path, as before.
• Effect: routes registered beneath the prefix still match first, since they're more specific. Registering the catch-all twice is still fine.
• Test: Test_RegisterCatchAll_Subtree has a router with a route under /api, a file server at /, and the catch-all. It checks the route, and JSON 404s for /api, /api/, /api/unknown and /api/unknown/too, while / and other paths stay the file server's. It fails without the fix.
• cmd/server: /api/unknown now gets a JSON 404 rather than plain text.

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the API-prefix catch-all change.

No open issues 🎉

What changed in this PR

Extends the router’s catch-all handling so unknown paths beneath an API prefix return structured JSON 404 responses instead of falling through to a root file server.

Changes:

• Registers catch-all handlers for both the normalized prefix and its subtree, while preserving repeated registration.
• Adds regression coverage for known routes, unknown API paths, and file-server responses outside the prefix.

File	Description
pkg/​httprouter/​router.go	Adds subtree catch-all registration and updates its documentation.
pkg/​httprouter/​router_test.go	Tests JSON 404 handling, repeated registration, and root file-server behavior.

_{Review effort: Balanced}