jawsboot.Setup panics for relative prefixes containing parent segments

[linkdata]

Problem

jawsboot.Setup documents that prefix may be absolute, relative, or empty and promises clean, slash-rooted returned paths. It joins a relative prefix before adding the leading slash, so a parent-relative prefix remains unclean:

jw, _ := jaws.New()
defer jw.Close()

mux := http.NewServeMux()
_, _ = jawsboot.Setup(jw, mux.Handle, "../static")

Observed on Go 1.26.3:

panic=parsing "GET /../static/bootstrap.bundle.min.<hash>.js": at offset 4: non-CONNECT pattern with unclean path can never match

http.ServeMux.Handle rejects the unclean non-CONNECT pattern. This is a startup panic for an unusual but documented relative prefix; it is not a path-traversal or security claim.

Proposed fix

Root and clean the prefix before joining asset and source-map names—for example, join from /—so returned URLs and registered patterns remain identical, clean, and slash-rooted.

Acceptance criteria

• Calling Setup with "../static" does not panic and returns no error.
• Returned URLs are slash-rooted and satisfy u.Path == path.Clean(u.Path).
• Every returned asset URL resolves through the supplied http.ServeMux with status 200.
• Cleaned source-map probe routes return 404.
• Tests retain coverage for ordinary absolute, relative, empty, and literal-brace prefixes.

Related issues

#163 and #235 cover different prefix normalization and pattern-syntax edge cases.