Fix directory listing links broken by overzealous # encoding

[Copilot]

The # → %23 encoding in directory listing hrefs (from #50) also matched # inside HTML numeric entities like / (slash), turning them into &%2347; and producing 404s on every file link.

• bin/app.js: Use negative lookbehind (?<!&)# to only encode # that isn't part of an HTML entity
• test/test.js: Add assertion that / entities are preserved; fix existing assertion to allow # inside entities

- const encoded = href.replace(/#/g, '%23');
+ const encoded = href.replace(/(?<!&)#/g, '%23');