Package decoy serves an innocent-looking website ("заглушка") for every
request that doesn't carry the secret panel path. The goal: a visitor, DPI,
or scanner sees an ordinary site, never a hint that a VPN panel exists.
ServeHTTP serves the requested asset, falling back to the template's 404.html
(with a 404 status) for anything not found — so misses are indistinguishable
from a normal site's not-found page.