fix(pages): prioritize social preview route over static routes

Move social preview image handling before static route checking to prevent catch-all patterns like /*.png from shadowing the auto-generated OG card endpoint.

Also bumps gitcaddy-vault from v1.0.60 to v1.0.61.

go.mod

@@ -16,7 +16,7 @@ require (
 	connectrpc.com/connect v1.18.1
 
 	// GitCaddy Vault plugin (compiled-in)
-	git.marketally.com/gitcaddy/gitcaddy-vault v1.0.60
+	git.marketally.com/gitcaddy/gitcaddy-vault v1.0.61
 	gitea.com/go-chi/binding v0.0.0-20240430071103-39a851e106ed
 	gitea.com/go-chi/cache v0.2.1
 	gitea.com/go-chi/captcha v0.0.0-20240315150714-fb487f629098

routers/web/pages/pages.go

@@ -76,6 +76,13 @@ func ServeLandingPage(ctx *context.Context) {
 		}
 	}
 
+	// Handle social preview image before static routes so a catch-all
+	// like /*.png cannot shadow the auto-generated OG card.
+	if requestPath == "/social-preview.png" || requestPath == "/social-preview" {
+		serveSocialPreview(ctx, repo)
+		return
+	}
+
 	// Check for static route file serving
 	if len(config.Advanced.StaticRoutes) > 0 {
 		cleanPath := path.Clean(requestPath)
@@ -91,12 +98,6 @@ func ServeLandingPage(ctx *context.Context) {
 		return
 	}
 
-	// Handle social preview image
-	if requestPath == "/social-preview.png" || requestPath == "/social-preview" {
-		serveSocialPreview(ctx, repo)
-		return
-	}
-
 	// Handle asset requests (gallery images, custom assets)
 	// Uses /pages/assets/ to avoid conflict with Gitea's static /assets/ route
 	if assetPath, found := strings.CutPrefix(requestPath, "/pages/assets/"); found && assetPath != "" {