Read form fields from the POST body only (closes #160)

r.FormValue falls back to the query string, so
POST /source/{id}/targets?url=<secret> created a working target from a
value carried on the request line — where proxy logs, browser history
and Referer all record it. Every form read is now r.PostFormValue,
including the login password and both password-change fields, which had
the same defect in a more acute form.

The Sentry leg needed more than the query string. sentryhttp attaches
the whole request to the scope, and ApplyToEvent copies the teed body
into Request.Data with no SendDefaultPII guard — so reading every field
from the body only pointed every credential this change protects at the
one field the first revision did not scrub. Body and query are now
redacted, Cookies and Env cleared, and Headers reduced to an allowlist,
because the SDK's own filter removes four names and would otherwise ship
X-Csrf-Token and the shared secrets senders put on the receiver route.

Also adds json:"-" to Target.Config, APIKey.Key and Setting.Value —
TargetView is the masking barrier for the HTML path only, and the first
handler to marshal a model would serialise a bearer token or the session
encryption key.

Independently reviewed three times. The second review found the Data
leak and proved it with a scratch module; the third disproved the
PR's own claim that BeforeSend gets no request, so the README now
records that redacting unconditionally is a deliberate choice rather
than a limitation — which is what makes #179 cheap to fix.

internal/handlers/source_management.go

@@ -227,9 +227,9 @@ func (h *Handlers) HandleSourceCreateSubmit() http.HandlerFunc {
 			return
 		}
 
-		name := r.FormValue("name")
-		description := r.FormValue("description")
-		retentionStr := r.FormValue("retention_days")
+		name := r.PostFormValue("name")
+		description := r.PostFormValue("description")
+		retentionStr := r.PostFormValue("retention_days")
 
 		if name == "" {
 			w.WriteHeader(http.StatusBadRequest)
@@ -509,7 +509,7 @@ func (h *Handlers) applyWebhookEdit(
 ) {
 	// The body size cap is enforced by the MaxBodySize middleware,
 	// which runs before CSRF parses the form.
-	name := r.FormValue("name")
+	name := r.PostFormValue("name")
 	if name == "" {
 		data := map[string]any{
 			tmplKeyWebhook: webhook,
@@ -523,12 +523,12 @@ func (h *Handlers) applyWebhookEdit(
 	}
 
 	webhook.Name = name
-	webhook.Description = r.FormValue("description")
+	webhook.Description = r.PostFormValue("description")
 
 	// An empty field falls back to the stored value, so submitting the
 	// form without touching retention leaves the policy alone.
 	retentionDays, retErr := parseRetentionDays(
-		r.FormValue("retention_days"), webhook.RetentionDays,
+		r.PostFormValue("retention_days"), webhook.RetentionDays,
 	)
 	if retErr != nil {
 		data := map[string]any{
@@ -950,7 +950,7 @@ func (h *Handlers) HandleEntrypointCreate() http.HandlerFunc {
 			return
 		}
 
-		description := r.FormValue("description")
+		description := r.PostFormValue("description")
 
 		entrypoint := &database.Entrypoint{
 			WebhookID:   webhook.ID,
@@ -1020,11 +1020,18 @@ func (h *Handlers) processTargetCreate(
 ) {
 	// The body size cap is enforced by the MaxBodySize middleware,
 	// which runs before CSRF parses the form.
-	name := r.FormValue("name")
-	targetType := database.TargetType(r.FormValue("type"))
-	targetURL := r.FormValue("url")
-	maxRetriesStr := r.FormValue("max_retries")
-	expiry := r.FormValue("expiry")
+	//
+	// Every field here is read with PostFormValue, not FormValue.
+	// FormValue falls back to the query string, which would let
+	// `POST /source/{id}/targets?url=https://hooks.slack.com/...`
+	// configure a target from a value the request line carries — and
+	// the request line, unlike the body, is what logs, proxies,
+	// Referer headers and error trackers record.
+	name := r.PostFormValue("name")
+	targetType := database.TargetType(r.PostFormValue("type"))
+	targetURL := r.PostFormValue("url")
+	maxRetriesStr := r.PostFormValue("max_retries")
+	expiry := r.PostFormValue("expiry")
 
 	if name == "" {
 		http.Error(