Keep what was typed when a target or webhook edit is refused (closes #381)

A refused save on the target edit page now shows the edit form again,
with the reason above it and every value submitted, instead of a bare
text page; the status codes are unchanged. The webhook edit page keeps
the submitted name, description and retention the same way, while the
page still reports the stored retention.

Target edits are validated by setTargetFromForm, which newTarget now
uses too, so the add and edit forms accept and refuse the same things.
An empty max_retries keeps the target's own count.

The browser test also saves both edit pages with refused values.

Model: opus-5-5

internal/handlers/ui_copy_test.go

@@ -398,21 +398,21 @@ func TestTargetFormMaxRetriesCopyMatchesBehaviour(t *testing.T) {
 	)
 
 	// A slack target exercises the same max_retries field while needing
-	// only Config.URL from the edit template, so the test data stays
-	// minimal. The Target key mirrors the field names the template reads
-	// off the handler's view value.
+	// only a URL from the edit template, so the test data stays
+	// minimal. The Target and TargetForm keys mirror the field names
+	// the template reads off the handler's values.
 	editBody := renderPage(
 		t, h, sess, "target_edit.html", map[string]any{
 			dataKeyWebhook: webhook,
 			"Target": map[string]any{
-				"ID":         "tg-1",
-				"Name":       "t",
-				"Type":       "slack",
-				"Active":     true,
-				"MaxRetries": 3,
-				"Config": map[string]any{
-					"URL": "https://hooks.slack.com/services/x",
-				},
+				"ID":     "tg-1",
+				"Name":   "t",
+				"Type":   "slack",
+				"Active": true,
+			},
+			"TargetForm": map[string]any{
+				"URL":        "https://hooks.slack.com/services/x",
+				"MaxRetries": "3",
 			},
 			dataKeyError: "",
 		},