Keep test helpers out of the shipped binary (closes #506)

The test helpers lived in ordinary `testing.go` files inside the config, database, middleware and session packages, so they were built into the binary and the shared `test-support` lint rule could not see them. The four files are gone: the session's helpers move into its own `_test.go` file, and the rest into `configtest`, `databasetest` and `middlewaretest`, which the `depguard` deny list now names, so a non-test file importing them fails lint. The test-support packages build through the production constructors.

Judgement call: the session, the middleware and the webhook database manager now take the plain logger they log through, which the application wiring provides.
Judgement call: two idle-expiry tests move the stored timestamps back instead of advancing a fake clock.

Model: opus-5-5

README.md

@@ -2984,7 +2984,7 @@ webhooker/
 │   │   └── resetpw.go         # `webhooker resetpw`: set an account's password, stopped deployments only
 │   ├── config/
 │   │   ├── config.go          # Configuration loading from environment variables
-│   │   └── testing.go         # ClearEnvForTest: an empty environment for one test
+│   │   └── configtest/        # Test support: ClearEnv, an empty environment for one test
 │   ├── database/
 │   │   ├── base_model.go      # BaseModel with UUID primary keys
 │   │   ├── database.go        # GORM connection, migrations, admin seed
@@ -3001,8 +3001,8 @@ webhooker/
 │   │   ├── model_apikey.go    # APIKey entity
 │   │   ├── password.go        # Argon2id hashing and verification
 │   │   ├── retention.go       # Retention reaper (per-webhook event expiry)
-│   │   ├── testing.go         # NewTestDatabase: wrapper for tests, no fx lifecycle
-│   │   └── webhook_db_manager.go  # Per-webhook DB lifecycle manager
+│   │   ├── webhook_db_manager.go  # Per-webhook DB lifecycle manager
+│   │   └── databasetest/      # Test support: a WebhookDBManager for tests in other packages
 │   ├── datadir/
 │   │   └── lock.go            # Exclusive advisory lock on DATA_DIR (one instance)
 │   ├── globals/
@@ -3063,7 +3063,7 @@ webhooker/
 │   │   ├── csrf.go            # CSRF protection middleware (gorilla/csrf)
 │   │   ├── ratelimit.go       # Per-IP rate limiting middleware (go-chi/httprate)
 │   │   ├── loginguard.go      # Login failure counters and the Argon2id verification semaphore
-│   │   └── testing.go         # NewForTest: Middleware without the fx lifecycle
+│   │   └── middlewaretest/    # Test support: a Middleware for tests in other packages
 │   ├── reqtls/
 │   │   └── reqtls.go          # IsTLS: the one TLS predicate, r.TLS or X-Forwarded-Proto
 │   ├── server/
@@ -3071,8 +3071,7 @@ webhooker/
 │   │   ├── http.go            # HTTP server setup with timeouts
 │   │   └── routes.go          # All route definitions
 │   ├── session/
-│   │   ├── session.go         # Cookie-based session management
-│   │   └── testing.go         # NewForTest: Session without the fx lifecycle
+│   │   └── session.go         # Cookie-based session management
 │   └── versionscript/
 │       └── doc.go             # Tests for script/version and the build files that use it
 ├── static/