fix(proxy): keep API paths ending in a file extension behind the proxy

The proxy matcher left out every path ending in an image or text extension
so static files skip it. The exclusion was not anchored, so an API path
whose last segment the caller chooses (a custom tag name ending in .png)
skipped the proxy too, and with it the demo-mode write refusal, the
worker-only refusal and the security headers. Authentication was unaffected.

The extension exclusion now applies outside /api/ only.

src/__tests__/proxy-body-limit.test.ts

@@ -102,9 +102,18 @@ describe("proxy matcher", () => {
       "/api/import/csv/preview",
       // The composition PUT beside the label upload stays behind the proxy.
       "/api/medications/abc/ingredients",
+      // An API path ending in a static-file extension is still an API call:
+      // the last segment is the caller's choice.
+      "/api/mood/tags/custom/x.png",
+      "/api/documents/inbound/abc.txt",
+      "/api/measurements/x.svg",
     ]) {
       expect(re.test(path), path).toBe(true);
     }
+    // Static files outside the API still skip it.
+    for (const path of ["/icons/icon-192.png", "/og.jpg", "/robots.txt"]) {
+      expect(re.test(path), path).toBe(false);
+    }
   });
 });