Move webhook pages to /hook/ID and inbound URLs to /h/UUID (closes #367)

The webhook page and everything under it move from /source/ID to
/hook/ID, the list and new-webhook form to /hooks and /hooks/new, and
the event log from .../logs to /hook/ID/events, body download
included. Entrypoint URLs move from /webhook/UUID to /h/UUID, and the
webhook page shows only that form. The old paths are gone.

Links, redirects, form actions, tests, comments and the README follow.
Both links to the event log page, and its title and heading, now read
"Full Event Log". Go identifiers and template file names are
unchanged. Route tests reach every moved page and form through the
production router, taking each URL and token from the rendered page.

Model: opus-5-5

internal/middleware/accesslog_test.go

@@ -119,7 +119,7 @@ func accessLogRouter(m *middleware.Middleware) *chi.Mux {
 	)
 
 	router.HandleFunc(
-		"/webhook/{uuid}",
+		"/h/{uuid}",
 		func(w http.ResponseWriter, r *http.Request) {
 			// Stands in for the real handler: an unknown entrypoint
 			// UUID 404s, a known one succeeds.
@@ -271,11 +271,11 @@ func TestAccessLog_InventedReceiverPathsLogRoutePattern(t *testing.T) {
 	assertFloodIsBounded(
 		t,
 		func(i int) string {
-			return "/webhook/" + attackerMarker +
+			return "/h/" + attackerMarker +
 				strings.Repeat("x", i) + "?q=" + attackerMarker
 		},
 		http.StatusNotFound,
-		"/webhook/{uuid}",
+		"/h/{uuid}",
 	)
 }
 
@@ -346,10 +346,10 @@ type sizeCase struct {
 func lineSizeCases() map[string]sizeCase {
 	cases := map[string]sizeCase{
 		"oversized path segment": {
-			target: "/webhook/" + attackerMarker +
+			target: "/h/" + attackerMarker +
 				strings.Repeat("x", oversizedSegmentBytes),
 			wantStatus: http.StatusNotFound,
-			wantURL:    "/webhook/{uuid}",
+			wantURL:    "/h/{uuid}",
 			bound:      maxLineBytes,
 		},
 		// /.well-known/healthcheck answers 200 to anyone and has no
@@ -605,14 +605,14 @@ func TestAccessLog_SuccessKeepsConcretePathAndRedactsQuery(
 	router := accessLogRouter(m)
 
 	assert.Equal(
-		t, http.StatusOK, get(t, router, "/webhook/known?src=ci"),
+		t, http.StatusOK, get(t, router, "/h/known?src=ci"),
 	)
 
 	// The path resolved against a stored entrypoint, so it stays. The
 	// query never does: see TestAccessLog_UnauthenticatedSuccess...
 	entries := accessLogEntries(t, buf)
 	require.Len(t, entries, 1)
-	assert.Equal(t, "/webhook/known?(redacted)", entries[0]["url"])
+	assert.Equal(t, "/h/known?(redacted)", entries[0]["url"])
 	assert.NotContains(t, buf.String(), "src=ci")
 }
 
@@ -640,7 +640,7 @@ func TestAccessLog_RetainsEveryOtherField(t *testing.T) {
 	assert.Equal(
 		t,
 		http.StatusNotFound,
-		get(t, router, "/webhook/"+attackerMarker),
+		get(t, router, "/h/"+attackerMarker),
 	)
 
 	entries := accessLogEntries(t, buf)