Label request metrics with standard HTTP methods only (closes #274)

The method label was each request's method as sent, and Go's HTTP
server accepts any method name, so made-up methods added series to the
registry that were never removed. It is now the method only for GET,
HEAD, POST, PUT, PATCH, DELETE, OPTIONS, CONNECT and TRACE, and "other"
for any other. go-http-metrics reads the method from the request it is
handed, so the middleware hands it a copy carrying the label and serves
the next handler the original request.

Model: opus-5-5

TODO.md

@@ -30,6 +30,15 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-15 the request metrics record any method that is not a standard one as
+  `other` (closes #274): their `method` label was each request's method as sent,
+  and Go's HTTP server accepts any method name, so a client sending made-up
+  methods added series to the Prometheus registry that were never removed. The
+  label is now the request's method only for `GET`, `HEAD`, `POST`, `PUT`,
+  `PATCH`, `DELETE`, `OPTIONS`, `CONNECT` and `TRACE`. The metrics library reads
+  the method from the request it is handed, so the metrics middleware hands it a
+  copy of the request carrying the label; the handlers still see the method the
+  client sent.
 - 2026-10-15 logging out ends every login session (closes #256): a login session
   was a cookie with nothing kept on the server, so `/logout` removed it from one
   browser and a copy of it kept working for its 30 days. Every login is made