Reserve slugs beginning with _ or .

Enforced at three layers: the site editor validates slug inputs before
committing (rename and new-page rows), the API rejects such paths in
_check_reserved (page save/delete, structure moves, editor socket), and
the content catch-all 404s them without a tree lookup.

docs/design-principles.md

@@ -32,6 +32,8 @@ evolves.
   lives under `/_/` (the API at `/_/api/`, uploaded files at `/_/f/`, built
   assets at `/_/assets/`, and the admin shell at `/_/admin`). The only
   other reserved root path is `/favicon.ico`, served from the build.
+  Slugs may not begin with `_` or `.` anywhere in the path — such URLs
+  are never looked up as content.
 - **Single user, trusted author.** No auth concerns in the core design.
   Everything published is public; only editing tools will later sit behind
   access control (external SSO when that time comes). The author is trusted