* fix(app-router): return 405 for non-action mutations to static pages
Static and SSG App Router page routes currently render HTML or RSC payloads for POST and PUT requests that are not server actions. That diverges from Next.js and makes unsupported mutation methods look successful.
The App Router page render path only handled server actions and route handlers before falling through to page rendering. Add a small page-method policy helper and call it from the generated RSC entry before page rendering so static and SSG candidates return 405 with Allow: GET, HEAD while possible server action POSTs still pass through.
Tests cover the helper policy and the live App Router fixture for static and ISR pages.
* fix(app-router): preserve 405 allow header
Set the App Router page 405 Allow header after merging middleware response headers so middleware cannot clobber the methods advertised by the generated Method Not Allowed response.
Add a focused regression test that keeps middleware header propagation while asserting Allow remains GET, HEAD.
Nathan Nguyen