Keep the entrypoint UUID out of webhooker's own logs (closes #531)

On the receiver route the access log and the per-entrypoint 429 line
name the route pattern whatever the status. A request chi never routed,
such as a dev-mode CORS preflight to the receiver, logs (unmatched)
whatever the status. The received line names the entrypoint and webhook
IDs, and the unknown-entrypoint line logs no path. The pattern is
middleware.ReceiverRoute, which routes.go registers the receiver with.

The README says the proxy's access log holds the UUID and must be
protected like the URL, and its access-log, rate-limit, Sentry and
log-size passages now match the code.

Model: opus-5-5

internal/middleware/metrics.go

@@ -41,7 +41,8 @@ const unmatchedMethod = unmatchedRoute
 // after /h/ is client-chosen, so labelling by path lets any
 // unauthenticated client mint permanent series at will, and publishes
 // the entrypoint UUID (the receiver's only credential) in the scrape
-// while doing it.
+// while doing it. The access log and the 429 line read it for the
+// same reason: see ReceiverRoute.
 //
 // chi populates the route context during routeHTTP, so this is only
 // valid once routing has run. Every caller below is on the recording