Render admin page errors in the normal layout (closes #382)

Every 400, 403, 404 and 500 on an admin page now answers with an
error page in the normal layout: one fixed line for the status and a
link back to the webhook list, or to sign-in when nobody is signed
in. The router's handler for unknown paths, the CSRF middleware's
refusal and a panic in an admin page route group use the same page;
each such group has its own recoverer and error reporting for that.
The page always sends Cache-Control: no-store. Status codes are
unchanged. The receiver, the healthcheck and /metrics keep their
plain answers. If the error page cannot render, or panics, the answer
is the same status in plain text.

Model: opus-5-5

README.md

@@ -2932,6 +2932,12 @@ local record instead of nothing. What that placement gives up is
 recovery of a panic in the six entries above it, none of which does
 more than set a header or start a timer.
 
+Each admin page route group (`/pages`, `/user/*`, `/sources`,
+`/source/*`) starts with its own **Recoverer** and, if `SENTRY_DSN` is
+set, its own **Sentry** error reporting. That Recoverer answers a panic
+with the `500` error page in the normal layout; the global one keeps
+the plain-text `500` for every other route.
+
 Additionally, form endpoints (`/pages`, `/user/*`, `/sources`,
 `/source/*`) apply a **MaxBodySize** middleware that limits
 POST/PUT/PATCH request bodies to 1 MB. It is registered ahead of the

internal/handlers/handlers.go

@@ -148,8 +148,9 @@ func New(
 }
 
 // HandleErrorPage returns a handler that answers every request with
-// the error page for status. The router uses it for unknown paths and
-// the CSRF middleware for a refused form.
+// the error page for status. The router uses it for unknown paths, the
+// CSRF middleware for a refused form, and each admin page route
+// group's recoverer for a panic.
 func (s *Handlers) HandleErrorPage(status int) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		s.renderError(w, r, status)

internal/middleware/recoverer.go

@@ -137,7 +137,9 @@ func (w *recoverResponseWriter) Unwrap() http.ResponseWriter {
 //
 // Unlike http.Error on its own, it deletes any Set-Cookie the handler
 // set before panicking, because a request that failed must not hand
-// the client a credential; every other header is left to http.Error.
+// the client a credential. It touches no other header: when page
+// answers, every other header the handler set goes out with it, apart
+// from any page sets itself; otherwise they are left to http.Error.
 // See https://git.eeqj.de/sneak/webhooker/issues/193.
 func (s *Middleware) Recoverer(
 	page http.Handler,

internal/server/routes.go

@@ -15,9 +15,10 @@ import (
 // bytes) for form POST endpoints. 1 MB is generous for any form
 // submission while preventing abuse from oversized payloads.
 //
-// Every route group below installs MaxBodySize(maxFormBodySize) as
-// its first middleware after the recoverer, ahead of both CSRF and
-// RequireAuth. Both orderings are deliberate.
+// The four admin page route groups below (/pages, /user/{username},
+// /sources and /source/{sourceID}) install MaxBodySize(maxFormBodySize)
+// right after their recoverer and error reporting, ahead of both CSRF
+// and RequireAuth. Both orderings are deliberate.
 //
 // Ahead of CSRF because gorilla/csrf parses the form. The cap has to
 // be installed before anything reads the body, or the parse runs