Mask the target URL in delivery errors, SSRF logs and log page data (closes #118)

A delivery target URL is itself a credential: a Slack incoming
webhook URL is a bearer token. Three paths still reproduced it
in full.

Transport failures were the worst of them. net/http embeds the
request URL in every *url.Error it returns, so any DNS, TLS,
timeout or dial failure wrote the whole webhook URL into
DeliveryResult.Error — on disk, in the per-webhook database,
behind a json tag that a REST API would serialize.

maskURL moves to url_mask.go and is exported as MaskURL, and
maskURLError joins it: it rebuilds the *url.Error with the URL
masked, keeping the operation and the wrapped cause, so a
refused connection still reads differently from a DNS failure
or a timeout and errors.Is/As/Timeout still work. It is applied
where the errors are raised — executeHTTPRequest, shared by the
Slack and HTTP targets, and the request-construction paths — so
downstream wrapping is safe by construction. url.Parse embeds
the URL too, so ValidateTargetURL's parse branch gets the same
treatment; its error is logged and shown.

The SSRF rejection log now records only the masked URL, and
loadTargetMap hands the event log page TargetViews and a
delivery projection instead of raw target rows, so the stored
config blob has no path to that template either.

internal/delivery/target_http.go

@@ -363,7 +363,8 @@ func (t *httpTarget) doHTTPRequest(
 	)
 	if reqErr != nil {
 		return 0, "", 0, fmt.Errorf(
-			"creating request: %w", reqErr,
+			"creating request: %w",
+			maskURLError(reqErr),
 		)
 	}
 
@@ -492,8 +493,19 @@ func applyRequestHeaders(
 // executeHTTPRequest sends an HTTP request using the provided
 // client. URLs are validated by the config parsers and the
 // SSRF-safe transport before reaching here.
+//
+// Transport failures are masked here, at the single point
+// where every target's request errors are born, because the
+// caller stores them in DeliveryResult.Error: an unmasked
+// *url.Error would write the target URL — the credential for
+// a Slack incoming webhook — into the per-webhook database.
 func executeHTTPRequest(
 	client *http.Client, req *http.Request,
 ) (*http.Response, error) {
-	return client.Do(req) //#nosec G704 -- validated URL, SSRF-safe transport
+	resp, err := client.Do(req) //#nosec G704 -- validated URL, SSRF-safe transport
+	if err != nil {
+		return nil, maskURLError(err)
+	}
+
+	return resp, nil
 }