Refuse document ids the read route cannot serve

[pid1]

Closes #53. Two commits, and the second one is optional: if you would rather not touch gin, drop de12acc and the first commit stands on its own. I have written them so that works cleanly.

ab61a39 refuses the write. update_progress now rejects a document id the read route cannot serve, with a new error rather than an overloaded one, so a client finds out immediately instead of losing progress silently. I left is_valid_key_field alone deliberately: usernames go through it too, and tightening it there would lock out existing accounts.

de12acc makes the already-written positions readable. gin substitutes a fixed [A-Za-z0-9_]+ for every named parameter in build_named_parameters and has no per-route override, so the read route cannot be fixed from this repository alone. The commit widens that to a single path segment through gin.patch, and relaxes the guard from the first commit in step so the two agree on what is servable. A slash is still refused, since it would change which route matches.

The reason to treat the second one as optional is that gin.patch is applied by the Dockerfile, so it reaches the documented Docker install and not a manual one. With only the first commit, new writes fail loudly and nothing is silently stranded, but positions already sitting in people's databases under a hyphen or a dot stay unreadable. With both, they come back with no client change and no migration.

28 tests pass, 26 of them the existing suite unchanged. The round trip test fails against an unpatched gin and passes with it, so the second commit is doing what it claims rather than being asserted.

Two notes while I was in there. The status nginx returns depends on the character: 404 for a hyphen or a dot, 400 for a space, so the test asserts only that the read is never served rather than pinning a code. And gin.patch already has a hunk whose line counts do not match its body, which GNU patch inside the Debian image tolerates and BSD patch on macOS rejects; I left it as it is, but it is worth knowing if anyone tries to apply the patch outside Docker.

---

This change is 

[Frenzie]

Yeah, best to drop the second commit.

[pid1]

Dropped, thanks. #56 is just the guard now, and gin.patch is untouched.