Move the test-only helpers out of the shipped db package (closes #248)

The server binary carried exported names that only tests call, including
raw SQL access and a way to weaken the password hash.

Delete testing.go, GetDB and SetBcryptCost from the shipped code, so
passwords always hash at bcrypt.DefaultCost. Move GetDB, GetOrCreateChannel,
JoinChannel and HasChannelInvite into export_test.go. Delete
GetClientHostInfo, whose remaining check GetLatestClientForSession covers.

Tests in other packages now build the database with db.New and run raw SQL
through dbtest.Exec. Handler tests that need a password only to log in store
one hashed at bcrypt.MinCost. Tests of PASS itself keep the real cost.

Model: opus-5-5

internal/db/queries.go

@@ -320,29 +320,6 @@ type ClientHostInfo struct {
 	Hostname string
 }
 
-// GetClientHostInfo returns the IP and hostname for a
-// client.
-func (database *Database) GetClientHostInfo(
-	ctx context.Context,
-	clientID int64,
-) (*ClientHostInfo, error) {
-	var info ClientHostInfo
-
-	err := database.conn.QueryRowContext(
-		ctx,
-		`SELECT ip, hostname
-		 FROM clients WHERE id = ?`,
-		clientID,
-	).Scan(&info.IP, &info.Hostname)
-	if err != nil {
-		return nil, fmt.Errorf(
-			"get client host info: %w", err,
-		)
-	}
-
-	return &info, nil
-}
-
 // SetSessionOper sets the is_oper flag on a session.
 func (database *Database) SetSessionOper(
 	ctx context.Context,
@@ -433,54 +410,6 @@ func (database *Database) GetChannelByName(
 	return channelID, nil
 }
 
-// GetOrCreateChannel returns channel id, creating if needed.
-// Uses INSERT OR IGNORE to avoid TOCTOU races.
-func (database *Database) GetOrCreateChannel(
-	ctx context.Context,
-	name string,
-) (int64, error) {
-	now := time.Now()
-
-	_, err := database.conn.ExecContext(ctx,
-		`INSERT OR IGNORE INTO channels
-		 (name, created_at, updated_at)
-		 VALUES (?, ?, ?)`,
-		name, now, now)
-	if err != nil {
-		return 0, fmt.Errorf("create channel: %w", err)
-	}
-
-	var channelID int64
-
-	err = database.conn.QueryRowContext(
-		ctx,
-		"SELECT id FROM channels WHERE name = ?",
-		name,
-	).Scan(&channelID)
-	if err != nil {
-		return 0, fmt.Errorf("get channel: %w", err)
-	}
-
-	return channelID, nil
-}
-
-// JoinChannel adds a session to a channel.
-func (database *Database) JoinChannel(
-	ctx context.Context,
-	channelID, sessionID int64,
-) error {
-	_, err := database.conn.ExecContext(ctx,
-		`INSERT OR IGNORE INTO channel_members
-		 (channel_id, session_id, joined_at)
-		 VALUES (?, ?, ?)`,
-		channelID, sessionID, time.Now())
-	if err != nil {
-		return fmt.Errorf("join channel: %w", err)
-	}
-
-	return nil
-}
-
 // Errors that CreateOrJoinChannel refuses a join with.
 var (
 	ErrBannedFromChannel = errors.New("banned from channel")
@@ -2460,28 +2389,6 @@ func (database *Database) AddChannelInvite(
 	return nil
 }
 
-// HasChannelInvite checks if a session has been invited
-// to a channel.
-func (database *Database) HasChannelInvite(
-	ctx context.Context,
-	channelID, sessionID int64,
-) (bool, error) {
-	var count int
-
-	err := database.conn.QueryRowContext(ctx,
-		`SELECT COUNT(*) FROM channel_invites
-		 WHERE channel_id = ? AND session_id = ?`,
-		channelID, sessionID,
-	).Scan(&count)
-	if err != nil {
-		return false, fmt.Errorf(
-			"check invite: %w", err,
-		)
-	}
-
-	return count > 0, nil
-}
-
 // --- Tier 2: Secret (+s) ---
 
 // IsChannelSecret checks if a channel has +s mode.