Route GORM's logger through slog and bound it (closes #178)

GORM's default logger printed the fully interpolated SQL to standard
output on every statement that returned an error, including a plain
record-not-found. On /webhook/{uuid} and on the login form the
interpolated parameter is client-chosen and unbounded, so an
unauthenticated client sized the operator's log, one line per request,
at no level the operator could turn down.

Every gorm.Open in the service now installs internal/gormlog, a
gormlogger.Interface over the service's *slog.Logger. Its lines take
the level the operator set and the handler internal/logger selected; a
record-not-found is not logged as an error, since it is the expected
outcome on both of those paths and each handler already records its
own miss at DEBUG without the SQL; slow statements are kept at WARN
above the same 200ms threshold GORM used; and every value it emits is
spent through internal/logfield, the same encoded-byte budget the
access log spends. MaxAccessLogLineBytes bounds a GORM line too, and
internal/gormlog asserts each line against the constant directly.

Trace orders its cases exactly as GORM's own Trace orders them --
error-that-is-not-a-miss, then slow, then routine -- so a statement
that both missed and ran slow is still reported as slow. Ordering the
drop first would have made this adapter strictly less observant than
the IgnoreRecordNotFoundError option it was chosen over, on the two
lookups the issue is about, and a miss is the statement most likely to
be slow.

The third gorm.Open, in the archive writer, was not named in the issue
and had the same default. All three sites are pinned independently:
internal/handlers covers the main and per-webhook databases,
internal/delivery covers the archive writer, whose type is unexported.
Reverting any one of the three to a bare &gorm.Config{} fails the
suite.

The flood test's per-line and volume assertions were vacuous, because
the replaced default logger wrote only to a buffer while everything
else went to the captured stdout. It now tees to stdout as GORM's real
default does, so a reverted call site lands in the same capture and
those assertions measure the whole writer set.

internal/logfield gains the zero-headroom budget assertion and the
rune-splitting case: a value built from one rune must keep exactly
MaxBytes/EncodedBytes(r) of them, which a raw-byte budget fails and a
LessOrEqual on the budget cannot catch.

README: the ceiling now covers GORM, and the writers it does not cover
are re-derived by measuring rather than by reading. fx's console
logger and the Go runtime write to standard error. net/http's nil
ErrorLog is not a separate writer at all -- slog.SetDefault redirects
the log package's default logger into internal/logger's handler, so
those lines arrive on standard output at INFO. A handler panic reaches
that same path because chi's Recoverer crashes before writing, filed
as #187, and is the widest
line the service can write: measured at roughly 2,770 bytes against
the stated 2,560, a width that moves with the goroutine number and the
source paths in the stack, so only the fact that it exceeds the
ceiling is stated as invariant.

README.md

@@ -1143,8 +1143,9 @@ query, and in each of `User-Agent`, `Referer` and `X-Request-Id`,
 including cases built from the characters the handlers escape, and
 against the widest access log line the service can be made to write: a
 5xx that keeps its concrete path while all three header fields are also
-at their budget. Every case runs through both handlers `internal/logger` can
-select — the JSON one and the text one it installs on a tty — since the
+at their budget. Every case runs through both handlers
+`internal/logger` can select — the JSON one and the text one it
+installs on a tty — since the
 two do not escape alike and the ceiling is quoted unqualified. Measured
 over a real connection, the widest line is 1,972 bytes.
 
@@ -1216,10 +1217,11 @@ falsifying the ceiling.
 **It covers GORM's statement logging as well.** GORM's own default
 logger printed the fully interpolated SQL — parameters and all — to
 standard output on every statement that returned an error, including a
-plain record-not-found, at a level no operator setting reached. Two of this service's lookups miss by design
-on unauthenticated routes: the entrypoint lookup behind
-`/webhook/{uuid}` and the user lookup behind the login form, whose path
-segment and submitted username the client picks outright. Every
+plain record-not-found, at a level no operator setting reached. Two of
+this service's lookups miss by design on unauthenticated routes: the
+entrypoint lookup behind `/webhook/{uuid}` and the user lookup behind
+the login form, whose path segment and submitted username the client
+picks outright. Every
 `gorm.Open` in the service now installs the adapter in
 `internal/gormlog` instead. It writes through the same `slog` logger as
 everything else, so its lines take the level the operator set and the