crypto: harden API surface

Make it explicit that expiration is not being tested with Decrypt, and
test that the expiration is meaningful with DecryptWithExpiration.

client: add config option to override API origin

If the config file contains an "api-origin" key for a service, prefer it
instead of "origin". This allows users to directly point the Python
frontend to the Go backend for local development, without having to
setup a reverse proxy.

This is the Go port of [1].

While at it, use GetOrigin for symmetry with the Python code.

[1]: https://git.sr.ht/~sircmpwn/meta.sr.ht/commit/6c2ee03923fe65423a2c55e6648f555c08db827a

Fix bug with internal authentication

Make authorization errors more specific

server: set max upload size to 1 GiB

client: populate NodeID from service name

database.Apply: add support for non-pointer fields

database.WithTx: rollback if func returns error

Previously, this only rolled back if the called function panicked. This
updates it to also roll back if the called function returns an error.

Fetch user PGP key for meta.sr.ht

Correct TODO for context which is invariant

Update dependencies

Prohibit OAuth client auth for revoked clients

Stash remote address in context

Encrypt outgoing emails

Sign outgoing emails

Print IP with "invalid source IP" authError

config: add GetOrigin function

This implements the same behavior as Python's srht.config.get_origin.

webhooks/legacy_test: verify headers are recorded

Deduplicate webhook headers on subsequent attempts

This also updates the database with the final payload headers, including
the signature and nonce, which are generated afresh for each attempt.

webhooks/legacy: increase specificity of logging