CX1: HTTPError fills empty message with request path

[espadonne]

Summary

• Empty message in HTTPError(w, r, status, "") callsites now falls back to req.URL.Path so the rendered 404 template names the URL the user tried to reach instead of rendering <code></code>. Most user-visible at the post-login-redirect → 404 path (deleted repo URL).
• Query strings are intentionally NOT included in the fallback to avoid leaking session tokens (e.g. ?token=...&return_to=...) into rendered HTML.
• Hardens the plain-text fallback inside HTTPError (only reached when the error template itself fails to render) to template.HTMLEscapeString the now-user-controllable message + request_id before Fprintf — closes the gosec G705 taint flow my change introduced.

Test plan

• go test ./internal/web/render/ — new tests pass:
  • TestHTTPError_EmptyMessageFallsBackToRequestPath — /octocat/hello-world renders in body
  • TestHTTPError_FallbackOmitsQueryString — ?token=secret does not leak into output
  • TestHTTPError_ExplicitMessageWins — non-empty caller message preserved verbatim
• golangci-lint run ./internal/web/render/... — 0 issues
• go build ./... — clean
• Manual: shithub.sh post-login redirect to deleted repo, confirm the 404 page now names the URL instead of <code></code>

Closes audit finding CX1.