Show the not found page for unknown URLs

A catch-all rule raises NotFound, so unknown URLs pass the middlewares
and get the regular not found page instead of Flask's default 404.
Anonymous visitors are redirected to the login like for any other URL,
so they cannot tell which URLs exist.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

max/routes/__init__.py

@@ -1,5 +1,6 @@
 from max.auth import no_authentication_required
 from max.csrf import no_csrf
+from max.exceptions import NotFound
 
 from .alias.create import AliasCreate
 from .alias.delete import AliasDelete
@@ -21,6 +22,10 @@ from .user.toggle_can_use_different_alias_domain import (
 from .user.toggle_enabled import UserToggleEnabled
 
 
+def not_found(**kwargs):
+    raise NotFound()
+
+
 def init_routes(app):
     app.add_url_rule("/", "own-user-detail", UserDetail.as_view())
     app.add_url_rule("/list", "user-list", UserList.as_view())
@@ -78,3 +83,7 @@ def init_routes(app):
         "favicon",
         no_csrf(no_authentication_required(Favicon.as_view())),
     )
+
+    # Matches only URLs without another rule. They pass the middlewares like any
+    # other view, so the ExceptionMiddleware renders the not found page.
+    app.add_url_rule("/<path:path>", "not-found", not_found)