Move webhook pages to /hook/ID and inbound URLs to /h/UUID (closes #367)

The webhook page and everything under it move from /source/ID to
/hook/ID, the list and new-webhook form to /hooks and /hooks/new, and
the event log from .../logs to /hook/ID/events, body download
included. Entrypoint URLs move from /webhook/UUID to /h/UUID, and the
webhook page shows only that form. The old paths are gone.

Links, redirects, form actions, tests, comments and the README follow.
Go identifiers and template file names are unchanged. A new route test
posts to the entrypoint URL the webhook page shows and checks that the
receiver rate limit applies to it.

Model: opus-5-5

internal/handlers/logbound_test.go

@@ -4,7 +4,7 @@ package handlers_test
 // this package reach a value an UNAUTHENTICATED client picks outright
 // and of a length it picks outright:
 //
-//   - the unknown-entrypoint DEBUG line on /webhook/{uuid}, whose
+//   - the unknown-entrypoint DEBUG line on /h/{uuid}, whose
 //     path segment matched no stored entrypoint and so is bounded by
 //     nothing;
 //   - the failed-login DEBUG lines, whose username is a form field.
@@ -190,12 +190,12 @@ func assertNoClientText(t *testing.T, buf *bytes.Buffer) {
 // route pattern.
 func receiverRouter(h *handlers.Handlers) *chi.Mux {
 	router := chi.NewRouter()
-	router.Post("/webhook/{uuid}", h.HandleWebhook())
+	router.Post("/h/{uuid}", h.HandleWebhook())
 
 	return router
 }
 
-// postReceiver sends one POST at /webhook/<segment>.
+// postReceiver sends one POST at /h/<segment>.
 //
 // RawPath is cleared after parsing so chi routes on the decoded path
 // and the handler sees the raw bytes rather than their percent-escaped
@@ -210,7 +210,7 @@ func postReceiver(
 	req := httptest.NewRequestWithContext(
 		context.Background(),
 		http.MethodPost,
-		"/webhook/"+url.PathEscape(segment),
+		"/h/"+url.PathEscape(segment),
 		strings.NewReader(""),
 	)
 	req.URL.RawPath = ""
@@ -509,7 +509,7 @@ func TestVerificationCapacity_LogLineDoesNotTrackPathSize(
 					http.StatusServiceUnavailable,
 					postLoginAtPath(
 						t, h,
-						"/source/"+url.PathEscape(
+						"/hook/"+url.PathEscape(
 							oversizedFill(fill),
 						)+"/login",
 					),