Split source_management.go along its CRUD seams (closes #274)

`internal/handlers/source_management.go` had grown to about 2,370 lines holding the webhook, event log, entrypoint and target handlers, so unrelated units had to wait on each other to touch it. It is split, as pure code movement, into files named for what they hold: `webhook_list.go`, `webhook_create.go`, `webhook_detail.go`, `webhook_edit.go`, `webhook_delete.go`, `event_log.go`, `entrypoint.go`, `target_create.go`, `target_delete.go`, `target_toggle.go` and `shared.go`. No function body, signature, comment or behaviour changed. The README's file tree and log-line caveat, and one middleware comment, name the new files.

Model: opus-5-5

internal/middleware/middleware.go

@@ -131,8 +131,9 @@ const (
 	//
 	//   - Lines carrying an AUTHENTICATED operator's own input, which
 	//     are not truncated at all: the webhook name on "webhook
-	//     created" and the target host on "target URL blocked by SSRF
-	//     protection" (both internal/handlers/source_management.go),
+	//     created" (internal/handlers/webhook_create.go) and the target
+	//     host on "target URL blocked by SSRF protection"
+	//     (internal/handlers/target_create.go),
 	//     and target_name in internal/delivery/engine.go and
 	//     target_http.go. Each is bounded only by the 1 MB form body
 	//     cap, so a 100 KB name writes one line of roughly 600 KB.