docs: document request pipeline and UseStaticFiles/MapStaticAssets relationship in DeepDrftPublic

DeepDrftPublic/CLAUDE.md

@@ -70,9 +70,18 @@ Server-side `Program.cs` adds:
 - Forwarded headers
 - Calls to `Startup.ConfigureApiHttpClient` / `ConfigureContentServices` / `ConfigureDomainServices`
 
-## Reverse-proxy support
+## Request pipeline and middleware
 
-`UseForwardedHeaders()` runs first in the pipeline. HTTPS redirect is conditionally disabled via `ForwardedHeaders:DisableHttpsRedirection` so the app can sit behind nginx without forcing HTTPS at the host level.
+The middleware pipeline in `Program.cs` is ordered as follows:
+
+1. `UseForwardedHeaders()` — reads `X-Forwarded-*` headers from nginx. HTTPS redirect is conditionally disabled via `ForwardedHeaders:DisableHttpsRedirection` so the app can sit behind a reverse proxy without forcing HTTPS at the host level.
+2. Exception handler and HTTPS redirect (production only).
+3. `UseAntiforgery()` — required by Blazor form handling.
+4. **`UseStaticFiles()`** — serves compiled static assets from `wwwroot/` (including `/js/audio/*.js` compiled from TypeScript) with correct MIME types (`application/javascript` for `.js`). This must run *before* `MapStaticAssets()` to ensure production audio interop loads correctly.
+5. Cache-control middleware (dev only) — disables caching for `/_framework` and `/_content` assets.
+6. `MapStaticAssets()` — endpoint mapper for Blazor framework assets and remaining static content.
+7. Development-only `UseStaticFiles()` — serves raw TypeScript from `/Interop/` for source-map debugging.
+8. `MapControllers()` and `MapRazorComponents()` — route controller and component requests.
 
 ## The proxy controller