Read form fields from the POST body only (closes #160)

r.FormValue falls back to the query string, so
POST /source/{id}/targets?url=<secret> created a working target from a
value carried on the request line — where proxy logs, browser history
and Referer all record it. Every form read is now r.PostFormValue,
including the login password and both password-change fields, which had
the same defect in a more acute form.

The Sentry leg needed more than the query string. sentryhttp attaches
the whole request to the scope, and ApplyToEvent copies the teed body
into Request.Data with no SendDefaultPII guard — so reading every field
from the body only pointed every credential this change protects at the
one field the first revision did not scrub. Body and query are now
redacted, Cookies and Env cleared, and Headers reduced to an allowlist,
because the SDK's own filter removes four names and would otherwise ship
X-Csrf-Token and the shared secrets senders put on the receiver route.

Also adds json:"-" to Target.Config, APIKey.Key and Setting.Value —
TargetView is the masking barrier for the HTML path only, and the first
handler to marshal a model would serialise a bearer token or the session
encryption key.

Independently reviewed three times. The second review found the Data
leak and proved it with a scratch module; the third disproved the
PR's own claim that BeforeSend gets no request, so the README now
records that redacting unconditionally is a deliberate choice rather
than a limitation — which is what makes #179 cheap to fix.

internal/server/export_test.go

@@ -4,6 +4,7 @@ import (
 	"log/slog"
 	"net/http"
 
+	"github.com/getsentry/sentry-go"
 	"sneak.berlin/go/webhooker/internal/config"
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/middleware"
@@ -13,6 +14,25 @@ import (
 // build requests that sit exactly at, below, and above it.
 const MaxFormBodySizeForTest = maxFormBodySize
 
+// ScrubSentryRequestForTest exposes the BeforeSend hook that
+// enableSentry installs, so a test can assert on what it leaves in an
+// event without standing up a Sentry client.
+func ScrubSentryRequestForTest(
+	event *sentry.Event,
+	hint *sentry.EventHint,
+) *sentry.Event {
+	return scrubSentryRequest(event, hint)
+}
+
+// SentryClientOptionsForTest exposes the exact options enableSentry
+// initialises the SDK with, so a test can capture events through the
+// production hook wiring rather than a hand-built equivalent.
+func SentryClientOptionsForTest(
+	dsn, release string,
+) sentry.ClientOptions {
+	return sentryClientOptions(dsn, release)
+}
+
 // NewRouterForTest builds the real route tree via SetupRoutes with
 // the supplied middleware and handlers, bypassing the fx lifecycle
 // and the HTTP listener. Tests use it so that route-group middleware