fix: serve static files from public/ before server.js catch-all

- API routes (/api/*) still go to server.js
- All other routes serve from /public/ directory
- Fixes privacy.html, tos.html, manifest.json, robots.txt, sitemap.xml, og-image.svg

vercel.json

@@ -8,11 +8,15 @@
   ],
   "routes": [
     {
-      "src": "/(.*)",
+      "src": "/api/(.*)",
       "dest": "server.js",
       "headers": {
         "Access-Control-Allow-Origin": "*"
       }
+    },
+    {
+      "src": "/(.*)",
+      "dest": "/public/$1"
     }
   ]
 }