refactor(handler/http): extract Authenticator, SnifferBuilder, and normalizeRequest as testable units

Extract three pure-logic components from httpHandler to eliminate I/O
coupling from auth and sniffing construction, enabling synchronous unit
tests and reducing per-request allocation in sniffAndHandle:

- Authenticator struct with AuthResult return type — auth decisions no
  longer write to the connection; callers handle response I/O. Auth
  tests drop net.Pipe/goroutines for direct return-value assertions.
- SnifferBuilder pre-built in Init and reused per-connection via Build(),
  replacing inline sniffing.Sniffer{} construction in sniffAndHandle.
- normalizeRequest extracted to util.go with NormalizedRequest type,
  collapsing 20 lines of inline URL/normalisation into a single call.
- knockMatch extracted as standalone pure function.
- clampBodySize exported as ClampBodySize for cross-package use.
- util_test.go with 22 tests covering utility functions.
- helpers_test.go consolidates shared test fakes (logger, observer, conn).

handler/http/connect_test.go

@@ -18,6 +18,7 @@ func TestSniffAndHandle_NoMatch(t *testing.T) {
 		},
 	}
 	h.md.sniffing = true
+		h.sniffer = &SnifferBuilder{}
 
 	client, server := net.Pipe()
 	defer client.Close()
@@ -59,6 +60,7 @@ func TestSniffAndHandle_TLS(t *testing.T) {
 		},
 	}
 	h.md.sniffing = true
+		h.sniffer = &SnifferBuilder{}
 
 	client, server := net.Pipe()
 	defer client.Close()
@@ -115,6 +117,7 @@ func TestHandleConnect_SniffingEnabled(t *testing.T) {
 	h.md.proxyAgent = defaultProxyAgent
 	h.md.readTimeout = 15
 	h.md.sniffing = true
+		h.sniffer = &SnifferBuilder{}
 
 	client, server := net.Pipe()
 	defer client.Close()