better debug logging for events that failed signature check

currently all thats logged in the case of a failed http sig is the below. doesn't really help much when debugging after the fact

```
POST /users/maddy/inbox HTTP/1.0" 400 142 "-" "Mitra 4.5.1; https://public.mitra.social
```

Start by locating the HTTP signature validation path and the current request logging that produces the shown 400 response. Determine which failure details are safe and useful to record; done means failed signature checks provide actionable debugging context without exposing sensitive data.

Written by the indexing model from the issue text.