In this case, you’d actually want to use the hide option of file_server. It’s designed to do exactly this. There’s even an example that covers this exact thing!
But if you must use a matcher, you’d need to use path_regexp for this. The path matcher (which is what you get when you use a matcher token that starts with /, as explained in the Syntax section) doesn’t support matching across path segment boundaries with *.