Bound the event log's rendered bodies in the query (closes #135)

templates/source_logs.html rendered {{.Body}} untruncated. Bodies come
from the unauthenticated receiver under a 1 MB ingest cap, and since
renderTemplate started buffering a page instead of streaming it, a
25-event page of maximal bodies is tens of megabytes of resident memory
per concurrent viewer — inflated further by HTML escaping.

The cut happens in SQL, not in the template: loadEventsWithDeliveries
now selects substr(cast(body as blob), 1, 8192) with
length(cast(body as blob)) beside it, so an oversized body never
becomes a Go string at all. Truncating template-side would still
materialise the whole value and miss the point. The casts to blob make
substr and length count bytes rather than characters, so the bound
holds for any encoding.

Events reach the page as EventLogView, alongside the existing
DeliveryView and TargetView projections, carrying BodyTruncated and
BodyBytes so the page shows a marker with the true stored size.

SQLite cuts at an arbitrary byte, so trimPartialRune drops a trailing
sequence the cut left incomplete. Bytes that are merely invalid UTF-8 —
binary payloads, which this service receives — are left exactly as
stored: utf8.FullRune reports a complete sequence for an invalid
encoding too, so only a valid prefix awaiting its continuation bytes is
removed, and a tail with no rune start in its last utf8.UTFMax bytes is
untouched. A body that was not cut is never repaired.

Also corrects the executeTemplate comment that claimed these pages are
small.

internal/handlers/source_management.go

@@ -92,13 +92,6 @@ func parseRetentionDays(raw string, fallback int) (int, error) {
 	return v, nil
 }
 
-// EventWithDeliveries holds an event and its deliveries.
-type EventWithDeliveries struct {
-	database.Event
-
-	Deliveries []DeliveryView
-}
-
 // DeliveryView is the display-safe projection of a delivery
 // for the event log page. Its target is a TargetView, so the
 // stored configuration blob — which holds the target's
@@ -815,16 +808,18 @@ func (h *Handlers) parsePage(r *http.Request) int {
 }
 
 // loadEventsWithDeliveries loads paginated events and their
-// deliveries from the per-webhook database.
+// deliveries from the per-webhook database. Events come back
+// as capped projections rather than database.Event rows: see
+// eventLogColumns for why the cut happens in SQL.
 func (h *Handlers) loadEventsWithDeliveries(
 	w http.ResponseWriter,
 	webhook database.Webhook,
 	targetMap map[string]delivery.TargetView,
 	page int,
-) ([]EventWithDeliveries, int64) {
+) ([]EventLogView, int64) {
 	var totalEvents int64
 
-	var result []EventWithDeliveries
+	var result []EventLogView
 
 	if !h.dbMgr.DBExists(webhook.ID) {
 		return result, totalEvents
@@ -845,23 +840,25 @@ func (h *Handlers) loadEventsWithDeliveries(
 
 	offset := (page - 1) * paginationPerPage
 
-	var events []database.Event
+	var rows []eventLogRow
 
-	webhookDB.Where(
+	webhookDB.Model(&database.Event{}).Select(
+		eventLogColumns, maxRenderedBodyBytes,
+	).Where(
 		"webhook_id = ?", webhook.ID,
 	).Order("created_at DESC").Offset(offset).Limit(
 		paginationPerPage,
-	).Find(&events)
+	).Find(&rows)
 
-	result = make([]EventWithDeliveries, len(events))
+	result = make([]EventLogView, len(rows))
 
-	for i := range events {
-		result[i].Event = events[i]
+	for i := range rows {
+		result[i] = rows[i].view()
 
 		var deliveries []database.Delivery
 
 		webhookDB.Where(
-			"event_id = ?", events[i].ID,
+			"event_id = ?", rows[i].ID,
 		).Find(&deliveries)
 
 		result[i].Deliveries = newDeliveryViews(