fix: use root option in sendFile to avoid dotfile 500 on SPA refresh

When served via npx, the absolute path to index.html traverses .npm,
triggering Express 5 / send's dotfile guard. Using the root option
makes send only check the relative filename for dotfiles.

Fixes #48

server/src/app.ts

@@ -133,7 +133,7 @@ export async function createApp(
     if (uiDist) {
       app.use(express.static(uiDist));
       app.get(/.*/, (_req, res) => {
-        res.sendFile(path.join(uiDist, "index.html"));
+        res.sendFile("index.html", { root: uiDist });
       });
     } else {
       console.warn("[paperclip] UI dist not found; running in API-only mode");