server/directives: handle auth.AUTH_ANON_INTERNAL in Access

server: register SQL collector

Missed this step

Add prometheus SQL connection stats

Also updates the prometheus client_go library

Normalize remote address before saving to context

One cause for https://todo.sr.ht/~sircmpwn/meta.sr.ht/193 was that code
performing this sanitization was in multiple places, and a fix was not
applied in all places. There is no reasonable expectation for the port
to be present anyways, e.g. if the address is taken from a trusted
reverse proxy's header. Hence, perform the normalization here, so that
the code doing this in applications can be simplified.

Note that this does not yet fix the below ticket, it will just make the
fix easier.

References: https://todo.sr.ht/~sircmpwn/meta.sr.ht/193

email.EnqueueStd: Don't overwrite headers

Sometimes we need to specify the Message-Id, From, and Reply-To headers
(e.g. for todo.sr.ht ticket notifications). Don't overwrite these
headers if they are present.

go fmt

Allow AUTH_COOKIE to access @private fields

Add @anoninternal support code

This is a slightly better approach to the previous commit.

server/email: handle errors out of GQL context

server/email: include variables

server: move auth middlware ahead of RealIP

So that @internal auth can correctly test against internal-ipnet.

go fmt

Remove %e formatting verbs

%e is not valid for formatting error values:

> %e	scientific notation, e.g. -1.234456e+78

Instead, use %w when using fmt.Errorf (for error wrapping) and
%v when using log.Printf (%w is not valid in that context).

auth: harden grants structure

This replaces the Access map with a data type whose default value does
not grant any permissions, so that it's more difficult to create an
insecure auth context by mistake.

server: add @private directive glue code

Enforce complexity limit on webhook payload

Configure server to manage mail queue

This also sets up the recovery function for webhooks, so we get emailed
when we panic during a webhook query.

server: add server reference to context

webhooks: initial prototype for GQL-native webhooks

Fix bug with internal authentication