Move the test-only helpers out of the shipped db package (closes #248)

The server binary carried exported names that only tests call, including
raw SQL access and a way to weaken the password hash.

Delete testing.go, GetDB and SetBcryptCost from the shipped code, so
passwords always hash at bcrypt.DefaultCost. Move GetDB, GetOrCreateChannel,
JoinChannel and HasChannelInvite into export_test.go. Delete
GetClientHostInfo, whose remaining check GetLatestClientForSession covers.

Tests in other packages now build the database with db.New and run raw SQL
through dbtest.Exec. Handler tests that need a password only to log in store
one hashed at bcrypt.MinCost. Tests of PASS itself keep the real cost.

Model: opus-5-5

internal/handlers/api_test.go

@@ -23,6 +23,7 @@ import (
 
 	"go.uber.org/fx"
 	"go.uber.org/fx/fxtest"
+	"golang.org/x/crypto/bcrypt"
 	"modernc.org/sqlite"
 	"sneak.berlin/go/neoirc/internal/broker"
 	api "sneak.berlin/go/neoirc/internal/cli/api"
@@ -862,10 +863,7 @@ func TestRequestBodyLimit(t *testing.T) {
 			tserver := newTestServer(t)
 			token := tserver.createSession(nick)
 
-			tserver.sendCommand(token, map[string]any{
+			tserver.setPassword(nick)
-				commandKey: irc.CmdPass,
-				bodyKey:    []string{testPassword},
-			})
 
 			bytesToLimit := maxMessageSize - len(endpoint.value)
 
@@ -1767,9 +1765,7 @@ func checkQuitRace(
 		firstToken := tserver.createSession(nick)
 		observerToken := tserver.createSession("raceobserver")
 
-		tserver.sendCommand(firstToken, map[string]any{
+		tserver.setPassword(nick)
-			commandKey: irc.CmdPass, bodyKey: []string{testPassword},
-		})
 
 		tokens := []string{firstToken, tserver.login(nick)}
 
@@ -1819,9 +1815,7 @@ func TestLogoutOfOneClientKeepsSession(t *testing.T) {
 	firstToken := tserver.createSession(nick)
 	observerToken := tserver.createSession("logoutobserver")
 
-	tserver.sendCommand(firstToken, map[string]any{
+	tserver.setPassword(nick)
-		commandKey: irc.CmdPass, bodyKey: []string{testPassword},
-	})
 
 	secondToken := tserver.login(nick)
 
@@ -2130,6 +2124,24 @@ func (tserver *testServer) longPoll(
 	return result.Messages, nil
 }
 
+// setPassword gives the session nick the password testPassword
+// without sending PASS. It hashes at bcrypt.MinCost, and a login
+// compares at the cost stored in the hash, so both are fast.
+func (tserver *testServer) setPassword(nick string) {
+	tserver.t.Helper()
+
+	hash, err := bcrypt.GenerateFromPassword(
+		[]byte(testPassword), bcrypt.MinCost,
+	)
+	if err != nil {
+		tserver.t.Fatalf("hash password: %v", err)
+	}
+
+	dbtest.Exec(tserver.t, tserver.dbURL,
+		"UPDATE sessions SET password_hash = '"+string(hash)+
+			"' WHERE nick = '"+nick+"'")
+}
+
 // login logs in to the session nick with testPassword and
 // returns the new client's token.
 func (tserver *testServer) login(nick string) string {
@@ -3737,13 +3749,8 @@ func TestLoginValid(t *testing.T) {
 
 	tserver := newTestServer(t)
 
-	// Create session and set password via PASS command.
+	tserver.createSession("loginuser")
-	token := tserver.createSession("loginuser")
+	tserver.setPassword("loginuser")
-
-	tserver.sendCommand(token, map[string]any{
-		commandKey: irc.CmdPass,
-		bodyKey:    []string{testPassword},
-	})
 
 	// Login with nick + password.
 	loginBody, err := json.Marshal(map[string]string{
@@ -3807,13 +3814,8 @@ func TestLoginWrongPassword(t *testing.T) {
 
 	tserver := newTestServer(t)
 
-	// Create session and set password via PASS command.
+	tserver.createSession("wrongpwuser")
-	token := tserver.createSession("wrongpwuser")
+	tserver.setPassword("wrongpwuser")
-
-	tserver.sendCommand(token, map[string]any{
-		commandKey: irc.CmdPass,
-		bodyKey:    []string{"correctpass1"},
-	})
 
 	postJSONExpectStatus(
 		t, tserver, "/api/v1/login",
@@ -4284,13 +4286,8 @@ func TestLoginRateLimitAllowsNormalUse(t *testing.T) {
 
 	tserver := newTestServer(t)
 
-	// Create session and set password via PASS command.
+	tserver.createSession("normaluser")
-	token := tserver.createSession("normaluser")
+	tserver.setPassword("normaluser")
-
-	tserver.sendCommand(token, map[string]any{
-		commandKey: irc.CmdPass,
-		bodyKey:    []string{testPassword},
-	})
 
 	// A single login should succeed without rate limiting.
 	loginBody, err := json.Marshal(map[string]string{