refactor(handler/http): extract Authenticator, SnifferBuilder, and normalizeRequest as testable units

Extract three pure-logic components from httpHandler to eliminate I/O
coupling from auth and sniffing construction, enabling synchronous unit
tests and reducing per-request allocation in sniffAndHandle:

- Authenticator struct with AuthResult return type — auth decisions no
  longer write to the connection; callers handle response I/O. Auth
  tests drop net.Pipe/goroutines for direct return-value assertions.
- SnifferBuilder pre-built in Init and reused per-connection via Build(),
  replacing inline sniffing.Sniffer{} construction in sniffAndHandle.
- normalizeRequest extracted to util.go with NormalizedRequest type,
  collapsing 20 lines of inline URL/normalisation into a single call.
- knockMatch extracted as standalone pure function.
- clampBodySize exported as ClampBodySize for cross-package use.
- util_test.go with 22 tests covering utility functions.
- helpers_test.go consolidates shared test fakes (logger, observer, conn).

handler/http/websocket.go

@@ -101,15 +101,7 @@ func (h *httpHandler) copyWebsocketFrame(w io.Writer, r io.Reader, buf *bytes.Bu
 		MaskKey: fr.Header.MaskKey,
 		Length:  fr.Header.PayloadLength,
 	}
-	if opts := h.recorder.Options; opts != nil && opts.HTTPBody {
-		bodySize := opts.MaxBodySize
-		if bodySize <= 0 {
-			bodySize = sniffing.DefaultBodySize
-		}
-		if bodySize > sniffing.MaxBodySize {
-			bodySize = sniffing.MaxBodySize
-		}
-
+	if bodySize := sniffing.ClampBodySize(h.recorder.Options); bodySize > 0 {
 		buf.Reset()
 		if _, err := io.Copy(buf, io.LimitReader(fr.Data, int64(bodySize))); err != nil {
 			return err