The file route keeps its input and response policy explicit.

• Known IDs map to checked-in files.
• Unknown IDs return a 404 response.
• openLazyFile() opens the selected file lazily.
• createFileResponse() handles the response body and headers.
• Byte-range requests are disabled for these small fragments.

The explicit ID map prevents route parameters from becoming arbitrary filesystem paths.