Say the query logger drops bound values (closes #535)

The comment on MaxAccessLogLineBytes said the GORM adapter logs each
statement with the client's parameter written into it. Its
ParamsFilter drops every bound value, so the statement is logged with
its placeholders. The comment now says so and keeps the parts that
still hold: the widest line spends two budgets and the adapter's test
checks it against this constant.

The assertBounded doc no longer claims each line was cut, and the
postReceiver doc no longer explains itself by a log size test that is
gone.

Model: opus-5-5

internal/middleware/middleware.go

@@ -118,13 +118,13 @@ const (
 	// a caller on a parameterised route would supply, which is the
 	// only way those caps can be pinned at all.
 	//
-	// One writer in that set is not a handler's own slog call. The
-	// GORM adapter in internal/gormlog logs the statement with the
-	// client-chosen parameter already interpolated into it, which on
-	// the receiver and login lookups is exactly the value the budgets
-	// above exist for. Its widest line spends two logfield.MaxBytes
-	// budgets — the statement and the driver error — against a fixed
-	// portion smaller than this one's, and
+	// The GORM adapter in internal/gormlog writes through slog as well,
+	// though not from a handler. It logs each statement with its
+	// placeholders rather than the values bound to them (see its
+	// ParamsFilter), so the key a client sends to the receiver or login
+	// lookup does not reach its lines. Its widest line spends two
+	// logfield.MaxBytes budgets — the statement and the driver error —
+	// against a fixed portion smaller than this one's, and
 	// internal/gormlog/gormlog_test.go asserts every line it emits
 	// against this constant directly rather than leaving it as
 	// arithmetic.