Deploy main eacf1e7 to prod

Replaces #559, which conflicted.

Model: opus-5-5

internal/gormlog/gormlog.go

@@ -7,7 +7,7 @@
 // SQL — parameters and all — for every statement that returns an
 // error, including gorm.ErrRecordNotFound. Two of this service's
 // lookups miss by design on unauthenticated routes: the entrypoint
-// lookup on /webhook/{uuid}, whose path segment the client picks
+// lookup on /h/{uuid}, whose path segment the client picks
 // outright, and the user lookup behind the login form, whose username
 // the client picks outright. Under the default logger each of those
 // misses printed an unbounded, attacker-chosen string, at no level the
@@ -111,9 +111,9 @@ func (l *Logger) LogMode(gormlogger.LogLevel) gormlogger.Interface {
 //
 // One GORM path does not consult this: (*gorm.DB).Scan records the
 // statement through gorm's own traceRecorder, which does not implement
-// this interface. No production code path calls it; its one caller is
-// internal/database/database_test.go:91, whose SELECT 1 binds nothing.
-// scan_guard_test.go fails if a non-test file calls it.
+// this interface. No production code path calls it; only tests do, and
+// what a test binds is fixture data. scan_guard_test.go fails if a
+// non-test file calls it.
 // (*gorm.DB).Pluck, Row and Raw all run through the normal callback
 // processor and are filtered.
 func (l *Logger) ParamsFilter(