refactor(handler/http): extract Authenticator, SnifferBuilder, and normalizeRequest as testable units

Extract three pure-logic components from httpHandler to eliminate I/O
coupling from auth and sniffing construction, enabling synchronous unit
tests and reducing per-request allocation in sniffAndHandle:

- Authenticator struct with AuthResult return type — auth decisions no
  longer write to the connection; callers handle response I/O. Auth
  tests drop net.Pipe/goroutines for direct return-value assertions.
- SnifferBuilder pre-built in Init and reused per-connection via Build(),
  replacing inline sniffing.Sniffer{} construction in sniffAndHandle.
- normalizeRequest extracted to util.go with NormalizedRequest type,
  collapsing 20 lines of inline URL/normalisation into a single call.
- knockMatch extracted as standalone pure function.
- clampBodySize exported as ClampBodySize for cross-package use.
- util_test.go with 22 tests covering utility functions.
- helpers_test.go consolidates shared test fakes (logger, observer, conn).

internal/util/sniffing/sniffer.go

@@ -106,10 +106,10 @@ type Sniffer struct {
 	ReadTimeout time.Duration
 }
 
-// clampBodySize returns the effective body capture size from recorder options,
+// ClampBodySize returns the effective body capture size from recorder options,
 // bounded by [DefaultBodySize, MaxBodySize]. Returns 0 if body recording is
 // disabled.
-func clampBodySize(opts *recorder.Options) int {
+func ClampBodySize(opts *recorder.Options) int {
 	if opts == nil || !opts.HTTPBody {
 		return 0
 	}