Event log: only the newest event expanded, and only the 50 most recent (closes #349)

The event log now loads only the 50 newest events, limited in its query, and only the newest starts expanded; the rest start collapsed. Paging is removed rather than capped, since 50 events never need a second page: the Previous and Next links, the `page` query parameter and the page number Replay and Resubmit carried back are gone, and a `?page=` left in an old link shows the 50 newest. A webhook with more than 50 events reads "50 most recent of N events" beside the heading. Comments and a README line that called `page` the only query parameter the service reads now name `next` and `notice`.

Model: opus-5-5

internal/middleware/middleware.go

@@ -278,12 +278,13 @@ func (lrw *loggingResponseWriter) Unwrap() http.ResponseWriter {
 // after the '?'. Keeping the path and dropping the query is what makes
 // this branch as bounded as the pattern branches below.
 //
-// Nothing debuggable is lost. One route in the service reads a query
-// parameter at all — `page`, on the authenticated pagination links in
-// internal/handlers/source_management.go — and the alternatives that
-// would preserve more (a key count, a key allowlist) all require
-// parsing an attacker-sized query on every request, which is work an
-// unauthenticated client would then be choosing for us.
+// Nothing debuggable is lost. The only query parameters the service
+// reads are the login page's `next`, the page to return to, and
+// `notice`, which names the line a page shows after an action. The
+// alternatives that would preserve more (a key count, a key
+// allowlist) all require parsing an attacker-sized query on every
+// request, which is work an unauthenticated client would then be
+// choosing for us.
 func concreteLogURL(r *http.Request) string {
 	path := r.URL.EscapedPath()