Write a form-error page's status only after it renders (closes #128)

Six form-error paths (the login error and the webhook form's validation and name-taken branches) called WriteHeader before rendering, so if the form page's own template failed, the answer kept its 400 or 409 status with an error body instead of a 500. The new renderTemplateStatus renders into the buffer and writes the status only after the page has rendered; renderTemplate sends 200 through it, and those handlers pass their status to it. No handler calls WriteHeader before a render. Login-form tests show the 400 page still renders in full and a failing template answers 500.

Model: opus-5-5

internal/handlers/source_management.go

@@ -350,12 +350,12 @@ func (h *Handlers) HandleSourceCreateSubmit() http.HandlerFunc {
 		retentionStr := r.PostFormValue("retention_days")
 
 		if name == "" {
-			w.WriteHeader(http.StatusBadRequest)
-			h.renderTemplate(
+			h.renderTemplateStatus(
 				w, r, "sources_new.html",
 				newSourceFormData(
 					"Name is required", name, description,
 				),
+				http.StatusBadRequest,
 			)
 
 			return
@@ -365,13 +365,13 @@ func (h *Handlers) HandleSourceCreateSubmit() http.HandlerFunc {
 			retentionStr, database.DefaultRetentionDays,
 		)
 		if retErr != nil {
-			w.WriteHeader(http.StatusBadRequest)
-			h.renderTemplate(
+			h.renderTemplateStatus(
 				w, r, "sources_new.html",
 				newSourceFormData(
 					retentionErrorMessage(retErr),
 					name, description,
 				),
+				http.StatusBadRequest,
 			)
 
 			return
@@ -644,8 +644,7 @@ func (h *Handlers) applyWebhookEdit(
 			tmplKeyError:   "Name is required",
 		}
 
-		w.WriteHeader(http.StatusBadRequest)
-		h.renderTemplate(w, r, "source_edit.html", data)
+		h.renderTemplateStatus(w, r, "source_edit.html", data, http.StatusBadRequest)
 
 		return
 	}
@@ -665,8 +664,7 @@ func (h *Handlers) applyWebhookEdit(
 			tmplKeyError:   retentionErrorMessage(retErr),
 		}
 
-		w.WriteHeader(http.StatusBadRequest)
-		h.renderTemplate(w, r, "source_edit.html", data)
+		h.renderTemplateStatus(w, r, "source_edit.html", data, http.StatusBadRequest)
 
 		return
 	}
@@ -703,8 +701,7 @@ func (h *Handlers) applyWebhookEdit(
 					"it, then save again.",
 			}
 
-			w.WriteHeader(http.StatusConflict)
-			h.renderTemplate(w, r, "source_edit.html", data)
+			h.renderTemplateStatus(w, r, "source_edit.html", data, http.StatusConflict)
 
 			return
 		}