I got the answer: the shortest path was just to put the images in resources/public/static/cards/ and then they did show up when referred to in the HTML as /static/cards/
One thing to note: by default if you create an uberjar, resources is included, so any images will be bundled as well. This is fine if you only have a few, but I ran into problems when I was serving 2k+ images from resources and my uberjar compilation times and size ballooned. The solution I found was to exclude the images directory and configure Apache to serve them directly.