refactor(handler/http): extract Authenticator, SnifferBuilder, and normalizeRequest as testable units

Extract three pure-logic components from httpHandler to eliminate I/O
coupling from auth and sniffing construction, enabling synchronous unit
tests and reducing per-request allocation in sniffAndHandle:

- Authenticator struct with AuthResult return type — auth decisions no
  longer write to the connection; callers handle response I/O. Auth
  tests drop net.Pipe/goroutines for direct return-value assertions.
- SnifferBuilder pre-built in Init and reused per-connection via Build(),
  replacing inline sniffing.Sniffer{} construction in sniffAndHandle.
- normalizeRequest extracted to util.go with NormalizedRequest type,
  collapsing 20 lines of inline URL/normalisation into a single call.
- knockMatch extracted as standalone pure function.
- clampBodySize exported as ClampBodySize for cross-package use.
- util_test.go with 22 tests covering utility functions.
- helpers_test.go consolidates shared test fakes (logger, observer, conn).

handler/http/udp_test.go

@@ -27,7 +27,7 @@ func TestHandleUDP_Disabled_WritesForbidden(t *testing.T) {
 	ro := &xrecorder.HandlerRecorderObject{}
 
 	go func() {
-		h.handleUDP(context.Background(), server, ro, &testLogger{})
+		h.handleUDP(context.Background(), server, "", ro, &testLogger{})
 	}()
 
 	br := bufio.NewReader(client)
@@ -59,7 +59,7 @@ func TestHandleUDP_Enabled_NilRouter(t *testing.T) {
 
 	go func() {
 		// OK response sent, then nil router causes error
-		err := h.handleUDP(context.Background(), server, ro, &testLogger{})
+		err := h.handleUDP(context.Background(), server, "", ro, &testLogger{})
 		if err == nil {
 			t.Log("expected error with nil router for UDP")
 		}