fix(r3): a NUL in the raw file path is a 404, not a 500

Compare's stages load their pictures through the catch-all file route, which
caught only OSError around resolve(); an embedded NUL raises ValueError. Same
class as resolve_booth's fix in f8d136a (heid bug hunt on the race fix,
hulda). The upload route's NUL-in-filename 500 is the same class and is left
to booth-dev: it is not on compare's path.

tests/test_compare.py

@@ -150,6 +150,16 @@ def test_hostile_booth_names_are_404_not_500(tmp_path):
         assert c.get(path).status_code == 404, path
 
 
+def test_a_nul_in_a_file_path_is_404_not_500(tmp_path):
+    """Compare's stages load their pictures through the raw file route. A NUL
+    in that path segment raises ValueError from resolve(), which is not an
+    OSError: still a 404 (heid bug hunt on the race fix, hulda)."""
+    _four(tmp_path)
+    c = _client(tmp_path)
+    for path in ("/b/g/p%00.png", "/b/g/p.png%00?thumb=1", "/b/g/sub%00/p.png?dl=1"):
+        assert c.get(path).status_code == 404, path
+
+
 def test_a_planted_fifo_marker_cannot_hang_a_look(tmp_path):
     """Recording a look never costs the page: a FIFO planted at `.viewed` must
     not block the open that touches it (heid bug hunt, hulda)."""