Move the test-only helpers out of the shipped db package (closes #248)

The server binary carried exported names that only tests call, including
raw SQL access and a way to weaken the password hash.

Delete testing.go, GetDB and SetBcryptCost from the shipped code, so
passwords always hash at bcrypt.DefaultCost. Move GetDB, GetOrCreateChannel,
JoinChannel and HasChannelInvite into export_test.go. Delete
GetClientHostInfo, whose remaining check GetLatestClientForSession covers.

Tests in other packages now build the database with db.New and run raw SQL
through dbtest.Exec. Handler tests and the relay tests' aliceWithHTTPClient
helper need a password only to log in, so they store one hashed at
bcrypt.MinCost. Tests of PASS itself keep the real cost.

Model: opus-5-5

internal/db/auth.go

@@ -10,13 +10,6 @@ import (
 	"golang.org/x/crypto/bcrypt"
 )
 
-//nolint:gochecknoglobals // var so tests can override via SetBcryptCost
-var bcryptCost = bcrypt.DefaultCost
-
-// SetBcryptCost overrides the bcrypt cost.
-// Use bcrypt.MinCost in tests to avoid slow hashing.
-func SetBcryptCost(cost int) { bcryptCost = cost }
-
 var errNoPassword = errors.New(
 	"account has no password set",
 )
@@ -29,7 +22,7 @@ func (database *Database) SetPassword(
 	password string,
 ) error {
 	hash, err := bcrypt.GenerateFromPassword(
-		[]byte(password), bcryptCost,
+		[]byte(password), bcrypt.DefaultCost,
 	)
 	if err != nil {
 		return fmt.Errorf("hash password: %w", err)