fix routes

test/app.test.js

@@ -1017,7 +1017,7 @@ test("public pages, workspace guards, and legacy chat links have distinct destin
         assert.match(await home.text(), /What would you like to do/);
         const chat = await fetch(server.baseUrl + "/app/chats/new", {headers: jar.headers()});
         const html = await chat.text();
-        assert.ok(html.includes('src="/script.js'));
+        assert.ok(html.includes('src="/js/script.js'));
         assert.ok(!html.includes('id="loginForm"'));
         assert.deepEqual((await request(server.baseUrl, "/chats", {jar})).json.chats, [], "home and chat pages do not create chats on GET");
         await request(server.baseUrl, "/logout", {method: "POST", body: {}, jar});
@@ -1071,7 +1071,7 @@ test("page headers share navigation and keep session markup private", async () =
 test("frontend scripts and styles revalidate across deployments", async () => {
     const server = await startTestServer({config: {staticMaxAge: "1h"}});
     try {
-        for (const asset of ["/script.js?v=20260909-account-controls", "/app/dom.js?v=20260909-account-controls", "/pages.css?v=20260909-account-controls"]) {
+        for (const asset of ["/js/script.js?v=20260909-account-controls", "/js/dom.js?v=20260909-account-controls", "/css/pages.css?v=20260909-account-controls"]) {
             const response = await fetch(server.baseUrl + asset);
             assert.equal(response.status, 200);
             assert.equal(response.headers.get("cache-control"), "no-cache");
@@ -1079,5 +1079,11 @@ test("frontend scripts and styles revalidate across deployments", async () => {
             assert.ok(etag);
             await response.text();
         }
+
+        for (const entrypoint of ["/js/script.js", "/js/settings.js", "/js/market.js"]) {
+            const response = await fetch(server.baseUrl + entrypoint);
+            assert.equal(response.status, 200);
+            assert.doesNotMatch(await response.text(), /from\s+["']\.\/js\//, `${entrypoint} must not resolve dependencies below /js/js`);
+        }
     } finally { await server.close(); }
 });