fix(backend): cut request log fields to the log bound (closes #60)

The request log wrote the URL, User-Agent, Referer and other
request-supplied strings with no length limit, and the server accepts
headers up to 1 MiB, so one request could put about 1 MiB per field
into a log line. Every string the request log takes from the request,
including the request ID chi copies from X-Request-Id, is now cut to
the 128-byte bound the report handler already used. That bound and
its helper moved from the handlers package to the logger package so
both use the one copy.

Model: opus-5-5

backend/internal/handlers/export_test.go

@@ -2,9 +2,6 @@ package handlers
 
 import "log/slog"
 
-// MaxLoggedFieldBytes exposes the log bound to the external tests.
-const MaxLoggedFieldBytes = maxLoggedFieldBytes
-
 // NewForTest builds a Handlers around a report sink and logger,
 // bypassing the fx graph so handler behaviour (including the
 // storage failure path) is exercisable in unit tests.