Shadow the stale pb_public pages the deploy leaves behind

A commit that deletes a file from pb_public does not delete it from the server —
the deploy only copies in. So /settings.html and /onboarding.html kept answering
200 after the swap, the second still offering a signup form that can now only
fail. Explicit routes shadow them, and go on working as bookmarks even after
someone clears the directory by hand.

pb_hooks/web.pb.js

@@ -10,10 +10,12 @@
 // `/tv` is the short form of `/get/tv`, because that URL gets typed on a
 // television remote inside the Downloader app, one character at a time.
 //
-// `onboarding.html` and `settings.html` are gone rather than left lying around.
+// `onboarding.html` and `settings.html` are gone from the repo but NOT from the
-// The first offered a signup form that can now only fail — registration is
+// server: the deploy copies files into `pb_public` and never deletes the ones a
-// owner-only — and a dead button is worse than no button. The second is a subset
+// commit removed, so both stale pages kept answering 200 after the swap. The old
-// of the sources section.
+// wizard still showed a signup form that can now only fail, which is worse than
+// no page at all. Explicit routes shadow the leftovers — and keep working as
+// bookmarks even once someone clears the directory by hand.
 
 routerAdd("GET", "/account", (e) => e.redirect(302, "/"))
 
@@ -22,3 +24,7 @@ routerAdd("GET", "/settings", (e) => e.redirect(302, "/#addons"))
 
 // Typing this on a remote is the actual cost being optimised.
 routerAdd("GET", "/tv", (e) => e.redirect(302, "/get/tv"))
+
+// Shadow the stale files the deploy left behind (see above).
+routerAdd("GET", "/settings.html", (e) => e.redirect(302, "/#addons"))
+routerAdd("GET", "/onboarding.html", (e) => e.redirect(302, "/"))