Give every JSON answer @meta, errors included (closes #201)

A panic in a JSON route's handler answered 500 with an empty body,
because the router's recoverer sits outside the middleware that adds
`@meta`. `JSONValidationMiddleware` now wraps the handler in the same
recoverer, and answers the panic with the JSON error body.

A method that `/status.json` or the health check does not take got
chi's empty 405. Each such method now goes to the JSON 405 that the
routes under `/api/v1` and `/ip` give.

The home page's IP lookup card showed only the answer's `data`. It now
shows the whole answer, `@meta` included.

A table test checks `@meta` on every JSON route, in its successes and
its errors.

Model: opus-5-5

README.md

@@ -233,7 +233,7 @@ originates no prefix and has no record in the database or in the AS list built
 into RouteWatch. AS 0 always answers 404, because it means no known origin. The
 AS name search never lists it. A prefix with no live route answers 404 too. The
 HTML pages give these errors as plain text. Under `/api/v1` and `/ip/`, a path
-no route matches answers 404 with the message `Not found`. A request with
+that matches no route answers 404 with the message `Not found`. A request with
 `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `TRACE` or `CONNECT` answers 405
 with `Method not allowed` on these routes:
 
@@ -241,8 +241,9 @@ with `Method not allowed` on these routes:
 - `/status.json`
 - `/.well-known/healthcheck.json`
 
-A 500 answer says only `Internal server error`, and a host name that does not
-resolve only `could not resolve host name`; the detail goes to the log.
+A 500 answer says only `Internal server error`. The error for a host name that
+does not resolve says only `could not resolve host name`. The detail goes to the
+log.
 
 Every answer carries `Strict-Transport-Security`, `Content-Security-Policy`,
 `X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy` and