fix(server): accept Windows backslash paths

[syj54p]

Fixes #2

What changed

Fix a Windows-only bug that caused the CreatPPT web workspace to return
403 Forbidden when opening the root URL.

In src/server/server.ts, serveClient() previously checked whether the
resolved client path started with ${root}/. On Windows, path.resolve()
returns paths using backslashes, so the prefix check failed even for valid
paths such as index.html.

The check now uses path.relative() together with the platform separator,
which works on both Windows and POSIX systems while preserving path traversal
protection.

Fixes #2

Validation

• npm run build
• TypeScript typecheck passed
• Client assets return HTTP 200
• / returns HTTP 200 with text/html
• /api/health returns HTTP 200
• /api/deck returns HTTP 200
• npm run check
• npm run audit:release
• npm run package:smoke
• Relevant browser E2E or focused tests

Release and safety

• No secrets, private decks, generated PPTX files, or unlicensed assets included
• No DeckSpec or PPTX compatibility impact
• Documentation update required

[syj54p]

PR #3 已关联 Issue #2。

已在 Windows 10、Node.js 22 环境验证：

• npm run build 通过
• 访问网页工作区根路径由 403 Forbidden 修复为 200 OK
• /api/health、/api/deck 和静态资源均返回 200

当前 GitHub Actions 显示 awaiting approval，可能需要维护者批准 workflow 运行。