Let a handler's flush reach the client through the access log (closes #191)

The access log's response writer had no Unwrap method, so
http.ResponseController stopped at it and a handler's Flush returned
http.ErrNotSupported. It now has one.

With metrics on, adding Unwrap alone is not enough: go-http-metrics'
writer only passes a flush on when the writer inside it has a Flush
method, and it sat inside Logging, so the flush silently did nothing.
Metrics is now registered outside Logging, and the README's middleware
list follows.

A new test flushes through the production router, with the defaults
and with metrics and Sentry on, on a global route and inside an admin
page route group.

Model: opus-5-5

internal/server/routes.go

@@ -61,16 +61,21 @@ func (s *Server) SetupRoutes() {
 func (s *Server) setupGlobalMiddleware() {
 	s.router.Use(middleware.RequestID)
 	s.router.Use(s.mw.SecurityHeaders())
-	s.router.Use(s.mw.Logging())
 
 	// Metrics recording middleware, registered only when the
 	// endpoint that exposes what it records is served. The
 	// condition is the same MetricsAuthEnabled the /metrics mount
 	// in setupRoutes reads.
+	//
+	// It goes outside Logging. go-http-metrics' writer passes a flush
+	// on only when the writer inside it has a Flush method, and the
+	// access log's writer has none, so inside Logging a handler's
+	// flush would silently do nothing.
 	if s.params.Config.MetricsAuthEnabled() {
 		s.router.Use(s.mw.Metrics())
 	}
 
+	s.router.Use(s.mw.Logging())
 	s.router.Use(s.mw.CORS())
 	s.router.Use(middleware.Timeout(requestTimeout))