Move the test-only helpers out of the shipped db package (closes #248)

The server binary carried exported names that only tests call, including
raw SQL access and a way to weaken the password hash.

Delete testing.go, GetDB and SetBcryptCost from the shipped code, so
passwords always hash at bcrypt.DefaultCost. Move GetDB, GetOrCreateChannel,
JoinChannel and HasChannelInvite into export_test.go. Delete
GetClientHostInfo, whose remaining check GetLatestClientForSession covers.

Tests in other packages now build the database with db.New and run raw SQL
through dbtest.Exec. Handler tests and the relay tests' aliceWithHTTPClient
helper need a password only to log in, so they store one hashed at
bcrypt.MinCost. Tests of PASS itself keep the real cost.

Model: opus-5-5

internal/ircserver/relay_test.go

@@ -8,6 +8,8 @@ import (
 	"testing"
 	"time"
 
+	"golang.org/x/crypto/bcrypt"
+	"sneak.berlin/go/neoirc/internal/dbtest"
 	"sneak.berlin/go/neoirc/internal/ircserver"
 	"sneak.berlin/go/neoirc/internal/service"
 )
@@ -583,8 +585,10 @@ func ownSessionCopies(
 
 // aliceWithHTTPClient connects alice to the IRC listener and
 // has her join #chan, which bob is on too, then adds an HTTP API
-// client to her session with the password her connection set,
-// as POST /api/v1/login does. It returns her connection, bob's
+// client to her session with a password, as POST /api/v1/login
+// does. It stores that password without sending PASS. It hashes
+// at bcrypt.MinCost, and a login compares at the cost stored in
+// the hash, so both are fast. It returns her connection, bob's
 // connection, her session and her HTTP API client.
 func aliceWithHTTPClient(
 	t *testing.T, env *testEnv,
@@ -594,15 +598,24 @@ func aliceWithHTTPClient(
 	const password = "alicepass"
 
 	alice := env.dial(t)
-	alice.send("PASS " + password)
 	alice.register("alice")
-	// Registration stores the password before the JOIN runs.
 	alice.joinAndDrain("#chan")
 
 	bob := env.dial(t)
 	bob.register("bob")
 	bob.joinAndDrain("#chan")
 
+	hash, err := bcrypt.GenerateFromPassword(
+		[]byte(password), bcrypt.MinCost,
+	)
+	if err != nil {
+		t.Fatalf("hash password: %v", err)
+	}
+
+	dbtest.Exec(t, env.dbURL,
+		"UPDATE sessions SET password_hash = '"+string(hash)+
+			"' WHERE nick = 'alice'")
+
 	sessionID, httpClientID, _, err := env.database.LoginUser(
 		t.Context(), "alice", password, "127.0.0.1", "localhost",
 	)