Block web access to bookstore-core's tests/vendor/composer files

They're bind-mounted straight into the webroot (docker-compose.*.yml) and
nothing strips them on a git-checkout deploy, so php_fastcgi/file_server
would otherwise execute/serve them directly. 404 instead of 403 so their
existence isn't confirmed. Verified live against a scratch Caddy instance
— plain `*` matches across path segments in Caddy 2.11.4 (the `**` token
I first tried did not match nested paths at all).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MqhgnCRjjVLFnZ3Jpn93Vg

docker/caddy/Caddyfile.production

@@ -10,6 +10,14 @@
 		max_size 32MB
 	}
 
+	# bookstore-core's tests/, vendor/, composer.json/.lock, and
+	# phpunit.xml.dist ship in the repo (and are bind-mounted straight into
+	# this container — see docker-compose.*.yml) so they exist under the
+	# webroot, but nothing about a git-checkout deploy strips them before
+	# they land here. 404 instead of 403 so their existence isn't confirmed.
+	@dev_only path /wp-content/plugins/bookstore-core/tests/* /wp-content/plugins/bookstore-core/vendor/* /wp-content/plugins/bookstore-core/composer.json /wp-content/plugins/bookstore-core/composer.lock /wp-content/plugins/bookstore-core/phpunit.xml*
+	respond @dev_only 404
+
 	php_fastcgi wordpress:9000
 	file_server