Wire service.Fat with one function per operation

[maragubot]

service.Fat was a flat struct: every method could reach every capability, and two of the three
fields (bucket, sender) were reached by nothing at all. This gives each operation a wiring
function that hands it exactly the capabilities it uses, mirroring how handlers are registered in
http.

• Fat keeps only ambient state (logger, tracer) and one private func field per operation.
  Capabilities leave the struct.
• One exported wiring function per operation: service.GetUser(f, db) takes *Fat first, then
  narrow private interfaces naming exactly the methods the operation calls, and sets the func field.
  An operation cannot reach a capability it was not given, because Fat holds none.
• Public methods stay methods, delegating to the field and panicking with the name of the wiring
  function when unwired — so *Fat keeps satisfying consumer-side interfaces like http.userGetter.
• Wiring an operation twice panics too, so the two ends of the lifecycle are enforced rather than
  documented: an operation is callable only after its one wiring, against the capabilities that
  wiring chose.
• service.NewFat takes global configuration only (a nil Log discards); service.Setup is
  wiring-only and called from main. servicetest.NewFat(t) constructs without wiring, with a
  t.Log-backed logger, so each test wires what it exercises.
• TestSetup reflects over the func fields, so an operation that gets a wiring function but never a
  line in Setup fails the test instead of panicking in production.

Four things are plumbed and waiting for their first operation, which is deliberate — this is a
template, and a project that starts here should find them already flowing:

• bucket and sender are parameters of service.Setup, passed from main. That keeps them out of
  Fat, where every operation could reach them, while leaving them one wiring function away. The
  doc on Setup says as much, so the unused parameters do not read as an oversight.
• log and tracer are ambient state on Fat itself, the tracer from otel.Tracer("app/service")
  to match otel.Tracer("app/http") in http.AddUserToContext. Every operation gets both for free;
  the one that exists does not happen to use either yet.

cmd/app/main.go is unchanged apart from the three wiring lines.

One thing worth a look: servicetest.NewFat losing its variadic options is a small API break for
anything already built on the template — tests now build their own database and pass it to the
wiring function.