The /tower/*splat catch-all was serving index.html for all sub-paths
including /tower/api/ws, which prevented the WebSocket upgrade from
reaching the ws server. Now requests matching /tower/api/* are passed
through via next() so they can be handled by the API router or the
WebSocket server.
Fixes#36
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>