Move the test-only helpers out of the shipped db package (closes #248)

The server binary carried exported names that only tests call, including
raw SQL access and a way to weaken the password hash.

Delete testing.go, GetDB and SetBcryptCost from the shipped code, so
passwords always hash at bcrypt.DefaultCost. Move GetDB, GetOrCreateChannel,
JoinChannel and HasChannelInvite into export_test.go. Delete
GetClientHostInfo, whose remaining check GetLatestClientForSession covers.

Tests in other packages now build the database with db.New and run raw SQL
through dbtest.Exec. Handler tests and the relay tests' aliceWithHTTPClient
helper need a password only to log in, so they store one hashed at
bcrypt.MinCost. Tests of PASS itself keep the real cost.

Model: opus-5-5

internal/db/queries_test.go

@@ -125,7 +125,7 @@ func TestCreateSessionStoresIP(t *testing.T) {
 	database := setupTestDB(t)
 	ctx := t.Context()
 
-	sessionID, clientID, _, err := database.CreateSession(
+	sessionID, _, _, err := database.CreateSession(
 		ctx, "ipuser", "ident", "host.example.com",
 		"192.168.1.42",
 	)
@@ -147,8 +147,8 @@ func TestCreateSessionStoresIP(t *testing.T) {
 		)
 	}
 
-	clientInfo, err := database.GetClientHostInfo(
-		ctx, clientID,
+	clientInfo, err := database.GetLatestClientForSession(
+		ctx, sessionID,
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -169,19 +169,6 @@ func TestCreateSessionStoresIP(t *testing.T) {
 	}
 }
 
-func TestGetClientHostInfoNotFound(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-
-	_, err := database.GetClientHostInfo(
-		t.Context(), 99999,
-	)
-	if err == nil {
-		t.Fatal("expected error for nonexistent client")
-	}
-}
-
 func TestGetSessionHostInfoNotFound(t *testing.T) {
 	t.Parallel()