Move the test-only helpers out of the shipped db package (closes #248)

The server binary carried exported names that only tests call, including
raw SQL access and a way to weaken the password hash.

Delete testing.go, GetDB and SetBcryptCost from the shipped code, so
passwords always hash at bcrypt.DefaultCost. Move GetDB, GetOrCreateChannel,
JoinChannel and HasChannelInvite into export_test.go. Delete
GetClientHostInfo, whose remaining check GetLatestClientForSession covers.

Tests in other packages now build the database with db.New and run raw SQL
through dbtest.Exec. Handler tests that need a password only to log in store
one hashed at bcrypt.MinCost. Tests of PASS itself keep the real cost.

Model: opus-5-5

internal/dbtest/dbtest.go

@@ -1,5 +1,5 @@
-// Package dbtest gives each test a database of its own. Only tests
-// may import it.
+// Package dbtest gives each test a database of its own and runs raw
+// SQL on it. Only tests may import it.
 package dbtest
 
 import (
@@ -37,3 +37,23 @@ func NewURL(tb testing.TB) string {
 
 	return dbURL
 }
+
+// Exec runs one raw SQL statement on the database at dbURL, over a
+// connection of its own. A test uses it for what the methods of
+// db.Database cannot do, such as creating a trigger that makes a
+// write fail.
+func Exec(tb testing.TB, dbURL, statement string) {
+	tb.Helper()
+
+	pool, err := sql.Open("sqlite", dbURL)
+	if err != nil {
+		tb.Fatalf("open test database: %v", err)
+	}
+
+	defer func() { _ = pool.Close() }()
+
+	_, err = pool.ExecContext(tb.Context(), statement)
+	if err != nil {
+		tb.Fatalf("run %q: %v", statement, err)
+	}
+}