dream: static file serving — mime, etags, 304, ranges, traversal guard + 28 tests

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/dream-on-sx.md

@@ -72,7 +72,7 @@ The five types: `request`, `response`, `handler = request -> response`, `middlew
 - [x] **WebSockets** in `lib/dream/websocket.sx`:
       - `dream-websocket handler` — upgrades request; handler `(fn (ws) ...)`.
       - `dream-send ws msg`, `dream-receive ws`, `dream-close ws`.
-- [ ] **Static files:** `dream-static root-path` — serves files, ETags, range requests.
+- [x] **Static files:** `dream-static root-path` — serves files, ETags, range requests.
 - [ ] **`dream-run`**: wires root handler into SX's `perform (:http-listen ...)`.
 - [ ] **Demos** in `lib/dream/demos/`:
       - `hello.ml` → `lib/dream/demos/hello.sx`: "Hello, World!" route.
@@ -182,6 +182,13 @@ Confirm scope before starting; some of these may be addable as Dream-internal he
   is `(perform op)`, tests use `dream-mock-ws` (in-memory inbox/outbox/closed via the
   cell pattern) with `dream-ws-sent` / `dream-ws-closed?` introspection and
   `dream-ws-run` to drive a handler. Echo loop + room broadcast verified.
+- **2026-06-07 — Static files** (`lib/dream/static.sx`, 28 tests). `dream-static root`
+  mounts at a `**` route and serves files: content-type by extension (mime map),
+  weak ETag (`"hash-length"`) with `If-None-Match` → 304 (incl. `*`), and `Range:
+  bytes=` requests → 206 with `Content-Range` (open-ended `bytes=N-` supported,
+  unsatisfiable → 416). `..`/absolute path traversal → 403; missing → 404; full
+  responses advertise `Accept-Ranges`. Filesystem is injectable —
+  `dream-static-perform-fs` (host) vs `dream-memory-fs` (in-memory map for tests).
 
 ## Blockers