fix(preview): guard malformed URI decode in HTML middleware

[AndrewMohawk]

Summary

• Avoids preview/dev server crashes on malformed percent-encoded URLs by safely decoding HTML paths.
• Treats invalid URL encodings as non-matching requests and falls through instead of throwing.
• Adds the same guard in full-bundle dev memory file serving.

Problem

decodeURIComponent is called on untrusted request paths in indexHtmlMiddleware (preview + dev)
and memoryFilesMiddleware (full-bundle dev). Malformed percent-encoding (e.g. /foo%ZZ.html)
throws URIError, which propagates out of the middleware and terminates the Node process.

Fix

• Wrap decodeURIComponent calls with a safe decode helper in the HTML middleware.
• Return next() when decoding fails, avoiding a hard crash.
• Add a try/catch around decodeURIComponent in memory file serving for the same reason.

Reproduction

1. Start preview: vite preview --host 127.0.0.1 --port 4175 --strictPort
2. Request a malformed URL: GET /foo%ZZ.html <-- used to crash
3. Before: process exits with URIError: URI malformed
4. After: request falls through and the server stays up

Testing

• Not run (behavioral change only; manual repro as above).