Serve an event's full stored body over HTTP (closes #157)

The 8 KB render cap from #135 left storage untouched but no route served
the rest, so a body over the cap was reachable only with filesystem
access to the SQLite files — in a product whose purpose is storing
webhooks so they can be inspected.

GET /source/{sourceID}/logs/{eventID}/body serves the whole body to the
webhook's owner, as application/octet-stream with an attachment
disposition and nosniff. Those are a security control, not formatting:
the bytes come from the public receiver and are handed back inside the
operator's authenticated origin, and the existing CSP would not stop a
stored HTML payload executing there. The truncation marker links to it
only when a body was actually cut.

Accepted deviation, documented rather than glossed: #157's definition of
done asks the route to stream from the row. It buffers whole instead,
because database/sql exposes no incremental handle on a SQLite BLOB and
substr range reads re-materialise the entire column per call — an
earlier revision chunked at 64 KiB and was 11-15x slower for a worse
bound. Three independent reviewers confirmed no streaming path exists.

Independently reviewed three times. Two earlier revisions each asserted
a memory bound the code did not have; the final reviewer measured
2.057x at the ingest cap and pinned the two overlapping allocations from
source — the driver's column buffer and database/sql's convertAssign
clone — confirming the stated "roughly two bodies, and 2x is a floor
not a ceiling" is now accurate, since SQLite's own materialisation sits
outside the Go heap.

internal/handlers/source_management.go

@@ -713,29 +713,55 @@ func (h *Handlers) evictArchiveWriterIfUnused(webhookID string) {
 	h.evictArchiveWriter(webhookID)
 }
 
+// ownedWebhook resolves the request's sourceID parameter to a
+// webhook the session's user owns.
+//
+// Ownership and existence are decided by one query, so a
+// webhook belonging to another user is indistinguishable from
+// one that does not exist: both are a 404, and neither confirms
+// the id. Callers that reach further into a webhook's data —
+// the event log page and the event body download — share this
+// one check rather than restating it, so the download cannot
+// come to authorize differently from the page that links to it.
+//
+// It reports false once it has written the response, which is a
+// redirect to the login page for an unauthenticated request and
+// a 404 otherwise. The caller returns without writing more.
+func (h *Handlers) ownedWebhook(
+	w http.ResponseWriter,
+	r *http.Request,
+) (database.Webhook, bool) {
+	var webhook database.Webhook
+
+	userID, ok := h.getUserID(r)
+	if !ok {
+		http.Redirect(
+			w, r, "/pages/login", http.StatusSeeOther,
+		)
+
+		return database.Webhook{}, false
+	}
+
+	sourceID := chi.URLParam(r, "sourceID")
+
+	err := h.db.DB().Where(
+		"id = ? AND user_id = ?", sourceID, userID,
+	).First(&webhook).Error
+	if err != nil {
+		http.NotFound(w, r)
+
+		return database.Webhook{}, false
+	}
+
+	return webhook, true
+}
+
 // HandleSourceLogs shows the request/response logs for a
 // webhook.
 func (h *Handlers) HandleSourceLogs() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		userID, ok := h.getUserID(r)
+		webhook, ok := h.ownedWebhook(w, r)
 		if !ok {
-			http.Redirect(
-				w, r, "/pages/login", http.StatusSeeOther,
-			)
-
-			return
-		}
-
-		sourceID := chi.URLParam(r, "sourceID")
-
-		var webhook database.Webhook
-
-		err := h.db.DB().Where(
-			"id = ? AND user_id = ?", sourceID, userID,
-		).First(&webhook).Error
-		if err != nil {
-			http.NotFound(w, r)
-
 			return
 		}