refactor(handler/http): extract Authenticator, SnifferBuilder, and normalizeRequest as testable units

Extract three pure-logic components from httpHandler to eliminate I/O
coupling from auth and sniffing construction, enabling synchronous unit
tests and reducing per-request allocation in sniffAndHandle:

- Authenticator struct with AuthResult return type — auth decisions no
  longer write to the connection; callers handle response I/O. Auth
  tests drop net.Pipe/goroutines for direct return-value assertions.
- SnifferBuilder pre-built in Init and reused per-connection via Build(),
  replacing inline sniffing.Sniffer{} construction in sniffAndHandle.
- normalizeRequest extracted to util.go with NormalizedRequest type,
  collapsing 20 lines of inline URL/normalisation into a single call.
- knockMatch extracted as standalone pure function.
- clampBodySize exported as ClampBodySize for cross-package use.
- util_test.go with 22 tests covering utility functions.
- helpers_test.go consolidates shared test fakes (logger, observer, conn).

internal/util/sniffing/sniffer.go

@@ -106,10 +106,10 @@ type Sniffer struct {
 	ReadTimeout time.Duration
 }
 
-// clampBodySize returns the effective body capture size from recorder options,
+// ClampBodySize returns the effective body capture size from recorder options,
 // bounded by [DefaultBodySize, MaxBodySize]. Returns 0 if body recording is
 // disabled.
-func clampBodySize(opts *recorder.Options) int {
+func ClampBodySize(opts *recorder.Options) int {
 	if opts == nil || !opts.HTTPBody {
 		return 0
 	}

internal/util/sniffing/sniffer_h2.go

@@ -139,7 +139,7 @@ func (h *h2Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 
 	var reqBody *xhttp.Body
-	if bodySize := clampBodySize(h.recorderOptions); bodySize > 0 && req.Body != nil {
+	if bodySize := ClampBodySize(h.recorderOptions); bodySize > 0 && req.Body != nil {
 		reqBody = xhttp.NewBody(req.Body, bodySize)
 		req.Body = reqBody
 	}
@@ -169,7 +169,7 @@ func (h *h2Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	h.setHeader(w, resp.Header)
 	w.WriteHeader(resp.StatusCode)
 
-	if bodySize := clampBodySize(h.recorderOptions); bodySize > 0 {
+	if bodySize := ClampBodySize(h.recorderOptions); bodySize > 0 {
 		respBody := xhttp.NewBody(resp.Body, bodySize)
 		resp.Body = respBody
 		io.Copy(w, resp.Body)

internal/util/sniffing/sniffer_http.go

@@ -179,7 +179,7 @@ func (h *Sniffer) httpRoundTrip(ctx context.Context, rw, cc io.ReadWriteCloser,
 	}
 
 	var reqBody *xhttp.Body
-	if bodySize := clampBodySize(h.RecorderOptions); bodySize > 0 && req.Body != nil {
+	if bodySize := ClampBodySize(h.RecorderOptions); bodySize > 0 && req.Body != nil {
 		reqBody = xhttp.NewBody(req.Body, bodySize)
 		req.Body = reqBody
 	}
@@ -239,7 +239,7 @@ func (h *Sniffer) httpRoundTrip(ctx context.Context, rw, cc io.ReadWriteCloser,
 	}
 
 	var respBody *xhttp.Body
-	if bodySize := clampBodySize(h.RecorderOptions); bodySize > 0 {
+	if bodySize := ClampBodySize(h.RecorderOptions); bodySize > 0 {
 		respBody = xhttp.NewBody(resp.Body, bodySize)
 		resp.Body = respBody
 	}

internal/util/sniffing/sniffer_test.go

@@ -62,8 +62,8 @@ func TestClampBodySize(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if got := clampBodySize(tt.opts); got != tt.want {
-				t.Errorf("clampBodySize() = %d, want %d", got, tt.want)
+			if got := ClampBodySize(tt.opts); got != tt.want {
+				t.Errorf("ClampBodySize() = %d, want %d", got, tt.want)
 			}
 		})
 	}

internal/util/sniffing/sniffer_ws.go

@@ -103,7 +103,7 @@ func (h *Sniffer) copyWebsocketFrame(w io.Writer, r io.Reader, buf *bytes.Buffer
 		Length:  fr.Header.PayloadLength,
 	}
 
-	if bodySize := clampBodySize(h.RecorderOptions); bodySize > 0 {
+	if bodySize := ClampBodySize(h.RecorderOptions); bodySize > 0 {
 		buf.Reset()
 		if _, err := io.Copy(buf, io.LimitReader(fr.Data, int64(bodySize))); err != nil {
 			return err