Render admin page errors in the normal layout (closes #382)

Every 400, 403, 404 and 500 on an admin page now answers with an error page in the normal layout: the status, one fixed line explaining it, and a link back to the webhook list, or to sign-in when nobody is signed in. Unknown paths reach it through the router's not-found handler, a refused form token through the CSRF middleware, and a panic through a recoverer each admin page route group installs first. Status codes are unchanged, and the page always sends Cache-Control: no-store.

If the error page fails to render, the answer is the same status in plain text; if it panics, the answer is a 500. The receiver, the healthcheck and /metrics keep their plain answers.

Model: opus-5-5

README.md

@@ -2984,6 +2984,12 @@ local record instead of nothing. What that placement gives up is
 recovery of a panic in the six entries above it, none of which does
 more than set a header or start a timer.
 
+Each admin page route group (`/pages`, `/user/*`, `/hooks`,
+`/hook/*`) starts with its own **Recoverer** and, if `SENTRY_DSN` is
+set, its own **Sentry** error reporting. That Recoverer answers a panic
+with the `500` error page in the normal layout; the global one keeps
+the plain-text `500` for every other route.
+
 Additionally, form endpoints (`/pages`, `/user/*`, `/hooks`,
 `/hook/*`) apply a **MaxBodySize** middleware that limits
 POST/PUT/PATCH request bodies to 1 MB. It is registered ahead of the