Previously /blog returned JSON 404 because only /blog/:slug was wired;
now app.get('/blog') serves the existing public/blog.html.
notFound middleware now detects browser GETs (Accept: text/html,
path not /api/*) and serves public/404.html; API clients keep JSON.
Added public/404.html styled to match the site theme.
Also cleaned up 11 pre-existing lint errors in src/server.js (unused
rate-limit/csrf imports, brace-style on the cache-control chain) while
editing the file.
