Answer HEAD requests and give 405 a plain message (closes #111)

Every route was registered for GET only, so HEAD answered 405, and on
the JSON routes that 405 said "Internal server error". chi's GetHead
now serves HEAD with the GET handler. The /api/v1 and /ip route groups
answer a path they lack with a JSON 404 "Not found", and another method
with a JSON 405 "Method not allowed" whose Allow header names GET and
HEAD. JSONValidationMiddleware gives a 4xx sent without a JSON body the
status's standard text instead of "Internal server error".

Model: opus-5-5

README.md

@@ -36,6 +36,8 @@ DEBUG=routewatch ./routewatch
 
 ## HTTP Endpoints
 
+Every route answers `HEAD` as it answers `GET`, without the body.
+
 ### Web Interface
 
 - `GET /` - Home page (HTML): headline figures, and lookups by AS number and by
@@ -90,8 +92,11 @@ and 4 seconds for the database reads behind `/status.json` and `/api/v1/stats`.
 An AS number, prefix or mask length that does not parse answers 400, as does a
 mask length out of range for its IP version. An AS the database does not hold,
 or a prefix with no live route, answers 404. The HTML pages give these errors as
-plain text. A 500 answer says only `Internal server error`, and a host name that
-does not resolve only `could not resolve host name`; the detail goes to the log.
+plain text. Under `/api/v1` and `/ip/`, a path no route matches answers 404 with
+the message `Not found`, and a method other than `GET` and `HEAD` answers 405
+with `Method not allowed`. A 500 answer says only `Internal server error`, and a
+host name that does not resolve only `could not resolve host name`; the detail
+goes to the log.
 
 Every answer carries `Strict-Transport-Security`, `Content-Security-Policy`,
 `X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy` and