Move SSR server bundle to private directory

- Configure webpack to output server bundle to app/assets/builds/
- Update React on Rails config to load server bundle from private location
- Add private directories to .gitignore to keep server bundles private

This follows React on Rails best practices by keeping server-side rendering
bundles in a private directory separate from public client assets for security.

Author: justin808

.gitignore

@@ -52,3 +52,10 @@ lib/bs
 /lib/ocaml
 
 client/app/bundles/comments/rescript/**/*.bs.js
+
+# Server-side rendering bundles (private)
+app/assets/builds/
+
+# Generated files
+client/app/generated/
+ssr-generated/

config/initializers/react_on_rails.rb

@@ -12,7 +12,8 @@
   # If you are never using server rendering, you may set this to "".
   # If you are using the same file for client and server rendering, having this set probably does
   # not affect performance.
-  config.server_bundle_js_file = "server-bundle.js"
+  # Server bundle is now in a private directory (not in public/)
+  config.server_bundle_js_file = Rails.root.join("app", "assets", "builds", "server-bundle.js").to_s
 
   # React on Rails 16 compatibility: Workaround for removed error handling
   #

config/webpack/serverWebpackConfig.js

@@ -45,12 +45,14 @@ const configureServer = () => {
 
   // Custom output for the server-bundle that matches the config in
   // config/initializers/react_on_rails.rb
+  // Output to a private directory for SSR bundles (not in public/)
+  const path = require('path');
   serverWebpackConfig.output = {
     filename: 'server-bundle.js',
     globalObject: 'this',
     // If using the React on Rails Pro node server renderer, uncomment the next line
     // libraryTarget: 'commonjs2',
-    path: config.outputPath,
+    path: path.resolve(__dirname, '../../app/assets/builds'),
     publicPath: config.publicPath,
     // https://webpack.js.org/configuration/output/#outputglobalobject
   };