Render admin page errors in the normal layout (closes #382)

Every 400, 403, 404 and 500 on an admin page now answers with an
error page in the normal layout: one fixed line for the status and a
link back to the webhook list, or to sign-in when nobody is signed
in. The router's handler for unknown paths, the CSRF middleware's
refusal and a panic in an admin page route group use the same page;
each such group has its own recoverer and error reporting for that.
The page always sends Cache-Control: no-store. Status codes are
unchanged. The receiver, the healthcheck and /metrics keep their
plain answers. If the error page cannot render, or panics, the answer
is the same status in plain text.

Model: opus-5-5

README.md

@@ -2932,6 +2932,12 @@ local record instead of nothing. What that placement gives up is
 recovery of a panic in the six entries above it, none of which does
 more than set a header or start a timer.
 
+Each admin page route group (`/pages`, `/user/*`, `/sources`,
+`/source/*`) starts with its own **Recoverer** and, if `SENTRY_DSN` is
+set, its own **Sentry** error reporting. That Recoverer answers a panic
+with the `500` error page in the normal layout; the global one keeps
+the plain-text `500` for every other route.
+
 Additionally, form endpoints (`/pages`, `/user/*`, `/sources`,
 `/source/*`) apply a **MaxBodySize** middleware that limits
 POST/PUT/PATCH request bodies to 1 MB. It is registered ahead of the