refactor(handler/http): extract Authenticator, SnifferBuilder, and normalizeRequest as testable units

Extract three pure-logic components from httpHandler to eliminate I/O
coupling from auth and sniffing construction, enabling synchronous unit
tests and reducing per-request allocation in sniffAndHandle:

- Authenticator struct with AuthResult return type — auth decisions no
  longer write to the connection; callers handle response I/O. Auth
  tests drop net.Pipe/goroutines for direct return-value assertions.
- SnifferBuilder pre-built in Init and reused per-connection via Build(),
  replacing inline sniffing.Sniffer{} construction in sniffAndHandle.
- normalizeRequest extracted to util.go with NormalizedRequest type,
  collapsing 20 lines of inline URL/normalisation into a single call.
- knockMatch extracted as standalone pure function.
- clampBodySize exported as ClampBodySize for cross-package use.
- util_test.go with 22 tests covering utility functions.
- helpers_test.go consolidates shared test fakes (logger, observer, conn).

handler/http/handler_test.go

@@ -8,14 +8,8 @@ import (
 	"time"
 
 	"github.com/go-gost/core/handler"
-	cmdata "github.com/go-gost/core/metadata"
-	"github.com/go-gost/core/observer"
-	xmetadata "github.com/go-gost/x/metadata"
 )
 
-func testMD(m map[string]any) cmdata.Metadata {
-	return xmetadata.NewMetadata(m)
-}
 
 func TestNewHandler(t *testing.T) {
 	h := NewHandler()
@@ -212,9 +206,3 @@ func TestSetupTrafficLimiter_NoObserver(t *testing.T) {
 	}
 }
 
-// testObserver implements observer.Observer for testing.
-type testObserver struct{}
-
-func (o *testObserver) Observe(ctx context.Context, events []observer.Event, opts ...observer.Option) error {
-	return nil
-}