Summary

Adds an asset proxy so framework-included webroot assets (CSS, JS) are served directly from framework_root/IncludedComponents/assets/ instead of having to be copied into each project's webroot. Projects register additional sources via zubzet()->assetProxy->registerWebRootSource($path).

Includes PR #133 (merged in): adds $res->json() as a first-class Response helper — sends raw JSON with Content-Type: application/json, applies JSON_THROW_ON_ERROR, and does not exit. Used by the AssetProxy e2e controller for cleanliness.

Security hardening

Review on the initial commit surfaced several unsafe paths in AssetProxy::serve(). All are now guarded and covered by e2e regressions:

• Path traversal — realpath() resolution + str_starts_with($resolved, $source . DIRECTORY_SEPARATOR) boundary check. Catches literal ../, URL-encoded %2e%2e%2f, sibling-prefix (webroot_security.txt next to webroot/), and symlink escapes.
• Source-root resolution — inputs like "", ".", "./" that realpath() collapses to the source directory itself are rejected by the boundary check (the resolved path equals the source without the trailing separator).
• Directory requests — is_file() check before readfile() so a directory path doesn't crash; returns 404.
• Null-byte injection — PHP 8's realpath() rejects null bytes natively; the fatal bubbles up and the masked extension trick (file.txt\0.png) cannot expose the real file.
• Unknown MIME types — FinfoMimeTypeDetector returns null for empty or unclassified files; falls back to application/octet-stream instead of emitting a malformed header.

Tests

tests/e2e/tests/cypress/e2e/core/asset-proxy.cy.js — 14 cases covering both the production route (/_zubzet/asset-proxy/...) and an isolated AssetProxyController that drives controlled inputs (null bytes, empty paths, symlinks) which the URL layer can't carry cleanly. Fixtures live in tests/e2e/webroot/assets/ and tests/e2e/webroot_security.txt (the sentinel used to detect content leakage).

Test plan

• /_zubzet/asset-proxy/js/Z.js returns 200 with Content-Type: application/javascript.
• /_zubzet/asset-proxy/css/bootstrap.min.css returns 200 with text/css.
• /_zubzet/asset-proxy/../../../../webroot_security.txt and the URL-encoded equivalent do not leak the sentinel.
• /_zubzet/asset-proxy//etc/passwd does not expose host files.
• Symlink inside source pointing outside is rejected.
• Directory path returns 404, doesn't crash.
• Unknown-extension file returns application/octet-stream.
• Null-byte suffix does not unmask the real extension.
• Empty / . / ./ inputs do not dump the source directory.

Merge order

1. Add $res->json() method for JSON responses #133 — $res->json() helper into this branch (merged)
2. This PR → main