put everything in a static directory

Tested by deleting everything, running npm install from scratch.
This helps ensure that only the files in the static subdirectory can be served.
Should eliminate serving config files via http.