Answer HEAD requests and give 405 a plain message (closes #111)

Every route was registered for GET only, so HEAD answered 405, and on
the JSON routes that 405 said "Internal server error". chi's GetHead
now serves HEAD with the GET handler. The /api/v1 and /ip route groups
answer a path they lack with a JSON 404 "Not found", and the other
methods the router knows (POST, PUT, PATCH, DELETE, OPTIONS, TRACE,
CONNECT) with a JSON 405 "Method not allowed" whose Allow header names
GET and HEAD. JSONValidationMiddleware gives a 4xx sent without a JSON
body the status's standard text instead of "Internal server error".

Model: opus-5-5

internal/server/middleware_internal_test.go

@@ -58,6 +58,34 @@ func TestResponsesCarrySecurityHeaders(t *testing.T) {
 	}
 }
 
+// TestJSONValidationKeeps4xxWithoutBody wraps a handler that answers 400
+// without a body in JSONValidationMiddleware and checks that the JSON error
+// body keeps the 400 and gives the status's own text. Before the fix it said
+// "Internal server error"
+// (https://git.eeqj.de/sneak/routewatch/issues/111).
+func TestJSONValidationKeeps4xxWithoutBody(t *testing.T) {
+	t.Parallel()
+
+	handler := JSONValidationMiddleware(http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusBadRequest)
+		}))
+
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, httptest.NewRequestWithContext(
+		t.Context(), http.MethodGet, "/", nil))
+
+	const name = "400 without a body"
+
+	if rec.Code != http.StatusBadRequest {
+		t.Errorf("%s: status %d, want %d; body %s",
+			name, rec.Code, http.StatusBadRequest, rec.Body)
+	}
+
+	checkJSONErrorCode(t, name, rec, http.StatusBadRequest)
+	checkJSONErrorMessage(t, name, rec, http.StatusText(http.StatusBadRequest))
+}
+
 // TestPagesCarryTheCSPNonce checks that every script and style block of each
 // page carries the nonce its Content-Security-Policy header names, so that the
 // browser runs and applies them, that each answer has a nonce of its own, and