Render admin page errors in the normal layout (closes #382)

Every 400, 403, 404 and 500 on an admin page now answers with an
error page in the normal layout: one fixed line for the status and a
link back to the webhook list, or to sign-in when nobody is signed
in. The router's handler for unknown paths, the CSRF middleware's
refusal and a panic in an admin page route group use the same page;
each such group has its own recoverer and error reporting for that.
The page always sends Cache-Control: no-store. Status codes are
unchanged. The receiver, the healthcheck and /metrics keep their
plain answers. If the error page fails to render, the answer is the
same status in plain text; if it panics, the answer is a 500.

Model: opus-5-5

internal/middleware/recoverer_test.go

@@ -76,7 +76,7 @@ func newRecovererProbe(
 	// Logging outside so the recovered 500 is the status it records.
 	router.Use(chimw.RequestID)
 	router.Use(m.Logging())
-	router.Use(m.Recoverer())
+	router.Use(m.Recoverer(nil))
 	router.Get("/probe", handler)
 
 	serverErrors := new(bytes.Buffer)
@@ -637,7 +637,7 @@ func TestRecovererKeepsResponseControllerWorking(t *testing.T) {
 
 	m, _ := capturingMiddleware(t)
 
-	handler := m.Recoverer()(http.HandlerFunc(
+	handler := m.Recoverer(nil)(http.HandlerFunc(
 		func(w http.ResponseWriter, _ *http.Request) {
 			_, _ = w.Write([]byte("chunk"))
 
@@ -672,3 +672,59 @@ func TestRecovererKeepsResponseControllerWorking(t *testing.T) {
 	assert.Equal(t, http.StatusOK, resp.StatusCode)
 	assert.Equal(t, "chunk", string(body))
 }
+
+// TestRecovererAnswersWithThePage covers a recoverer given a page:
+// the panic is logged as before, and the 500 is that page.
+func TestRecovererAnswersWithThePage(t *testing.T) {
+	t.Parallel()
+
+	m, logs := capturingMiddleware(t)
+
+	page := http.HandlerFunc(
+		func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte("the error page"))
+		},
+	)
+
+	w := httptest.NewRecorder()
+	m.Recoverer(page)(http.HandlerFunc(panicProbe)).ServeHTTP(
+		w, httptest.NewRequestWithContext(
+			t.Context(), http.MethodGet, "/", nil,
+		),
+	)
+
+	assert.Equal(t, http.StatusInternalServerError, w.Code)
+	assert.Equal(t, "the error page", w.Body.String())
+	assert.Contains(t, logs.String(), `"msg":"handler panic"`)
+	assert.Contains(t, logs.String(), panicMarker)
+}
+
+// TestRecovererFallsBackWhenThePagePanics covers a page that panics
+// before writing anything: both panics are logged, and the client
+// still gets the plain 500.
+func TestRecovererFallsBackWhenThePagePanics(t *testing.T) {
+	t.Parallel()
+
+	m, logs := capturingMiddleware(t)
+
+	const pagePanic = "QQERRORPAGEPANICQQ"
+
+	page := http.HandlerFunc(
+		func(http.ResponseWriter, *http.Request) {
+			panic(pagePanic)
+		},
+	)
+
+	w := httptest.NewRecorder()
+	m.Recoverer(page)(http.HandlerFunc(panicProbe)).ServeHTTP(
+		w, httptest.NewRequestWithContext(
+			t.Context(), http.MethodGet, "/", nil,
+		),
+	)
+
+	assert.Equal(t, http.StatusInternalServerError, w.Code)
+	assert.Equal(t, "Internal Server Error\n", w.Body.String())
+	assert.Contains(t, logs.String(), panicMarker)
+	assert.Contains(t, logs.String(), pagePanic)
+}