Stop serving the server's own source

Nothing secret is in it — the .env never enters the image and the client is
public JS regardless — but handing out server.py and the asset-pipeline
scripts to anyone who guesses a filename publishes the exact validation rules
for free.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server.py

@@ -91,9 +91,15 @@ class Handler(SimpleHTTPRequestHandler):
         self.wfile.write(body)
 
     def do_GET(self):
-        if self.path.split('?')[0] == '/api/scores':
+        path = self.path.split('?')[0]
+        if path == '/api/scores':
             with lock:
                 return self.reply(200, {'scores': public(load())})
+        # Don't hand out the source. Nothing secret lives in it — the .env is not in the image and
+        # the client is public JS regardless — but serving server.py and the asset-pipeline scripts
+        # to anyone who guesses the name is untidy, and it publishes the exact validation rules.
+        if path.endswith(('.py', '.pyc')) or '__pycache__' in path:
+            return self.send_error(404)
         return super().do_GET()
 
     def do_POST(self):