Stop the slow test packages waiting (closes #263)

- Tests hash passwords at bcrypt.MinCost, set through the
  PasswordCost field of db.Params. TestPasswordCost checks the
  cost with and without it.
- Test IRC servers check the queue only on broker notification;
  one test keeps the 100 ms fallback poll.
- The stop-timeout test shortens the timeout through a test-only
  setter.
- service and handlers tests build config.Config directly instead
  of through config.New, so they run in parallel. config exports
  DefaultTrustedProxies and ParseTrustedProxies for the handlers
  test config.
- Repeated race trials run as parallel subtests.
- Fixed sleeps become waits on the broker.
- A new test covers the relay's failed queue read, which only the
  100 ms poll had reached.

Model: opus-5-5

internal/config/config.go

@@ -36,9 +36,9 @@ Type /help for available commands.`
 const DefaultDBURL = "file:///var/lib/neoirc/state.db" +
 	"?_pragma=journal_mode(WAL)&_pragma=busy_timeout(5000)"
 
-// defaultTrustedProxies is TRUSTED_PROXIES when it is not set: the
+// DefaultTrustedProxies is TRUSTED_PROXIES when it is not set: the
 // private address ranges of RFC 1918.
-const defaultTrustedProxies = "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
+const DefaultTrustedProxies = "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
 
 var errOutOfRange = errors.New("setting out of range")
 
@@ -117,7 +117,7 @@ func New(
 	viper.SetDefault("LOGIN_RATE_LIMIT", "1")
 	viper.SetDefault("LOGIN_RATE_BURST", "5")
 	viper.SetDefault("IRC_LISTEN_ADDR", ":6667")
-	viper.SetDefault("TRUSTED_PROXIES", defaultTrustedProxies)
+	viper.SetDefault("TRUSTED_PROXIES", DefaultTrustedProxies)
 
 	err := viper.ReadInConfig()
 	if err != nil {
@@ -219,9 +219,7 @@ func parseStringAllowEmptyEnv(key string, value *string) error {
 	return parseString(key, value)
 }
 
-// parseTrustedProxies sets *value to the addresses in TRUSTED_PROXIES, a
-// comma-separated list of networks such as 10.0.0.0/8 and single
-// addresses such as 192.0.2.1. The empty string trusts nothing.
+// parseTrustedProxies sets *value to the addresses in TRUSTED_PROXIES.
 func parseTrustedProxies(value **netipx.IPSet) error {
 	var raw string
 
@@ -230,18 +228,7 @@ func parseTrustedProxies(value **netipx.IPSet) error {
 		return err
 	}
 
-	var builder netipx.IPSetBuilder
-
-	if strings.TrimSpace(raw) != "" {
-		for entry := range strings.SplitSeq(raw, ",") {
-			err = addTrustedProxy(&builder, strings.TrimSpace(entry))
-			if err != nil {
-				return fmt.Errorf("cannot parse TRUSTED_PROXIES: %w", err)
-			}
-		}
-	}
-
-	ipSet, err := builder.IPSet()
+	ipSet, err := ParseTrustedProxies(raw)
 	if err != nil {
 		return fmt.Errorf("cannot parse TRUSTED_PROXIES: %w", err)
 	}
@@ -251,6 +238,25 @@ func parseTrustedProxies(value **netipx.IPSet) error {
 	return nil
 }
 
+// ParseTrustedProxies returns the addresses in list, which has the form
+// of TRUSTED_PROXIES: a comma-separated list of networks such as
+// 10.0.0.0/8 and single addresses such as 192.0.2.1. The empty string
+// trusts nothing.
+func ParseTrustedProxies(list string) (*netipx.IPSet, error) {
+	var builder netipx.IPSetBuilder
+
+	if strings.TrimSpace(list) != "" {
+		for entry := range strings.SplitSeq(list, ",") {
+			err := addTrustedProxy(&builder, strings.TrimSpace(entry))
+			if err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	return builder.IPSet()
+}
+
 // addTrustedProxy adds entry, a network with a slash or a single
 // address, to builder. An IPv4 address written in IPv6 form, such as
 // ::ffff:192.0.2.1, is added as IPv4. A network in that form and an