Keep test helpers out of the shipped binary (closes #506)

The test helpers lived in ordinary `testing.go` files inside the config, database, middleware and session packages, so they were built into the binary and the shared `test-support` lint rule could not see them. The four files are gone: the session's helpers move into its own `_test.go` file, and the rest into `configtest`, `databasetest` and `middlewaretest`, which the `depguard` deny list now names, so a non-test file importing them fails lint. The test-support packages build through the production constructors.

Judgement call: the session, the middleware and the webhook database manager now take the plain logger they log through, which the application wiring provides.
Judgement call: two idle-expiry tests move the stored timestamps back instead of advancing a fake clock.

Model: opus-5-5

internal/config/dotenv_test.go

@@ -8,6 +8,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"sneak.berlin/go/webhooker/internal/config"
+	"sneak.berlin/go/webhooker/internal/config/configtest"
 )
 
 // dotEnvKey is a throwaway variable name the .env tests write and
@@ -39,9 +40,9 @@ func writeDotEnv(t *testing.T, contents string) string {
 // normally rather than be refused for a file it was never meant to
 // have.
 //
-//nolint:paralleltest // ClearEnvForTest uses t.Setenv.
+//nolint:paralleltest // ClearEnv uses t.Setenv.
 func TestLoadDotEnv_MissingFileIsFine(t *testing.T) {
-	config.ClearEnvForTest(t)
+	configtest.ClearEnv(t)
 
 	absent := filepath.Join(t.TempDir(), config.DotEnvPath)
 	require.NoError(t, config.LoadDotEnvFileForTest(absent))
@@ -54,9 +55,9 @@ func TestLoadDotEnv_MissingFileIsFine(t *testing.T) {
 // reaches the environment, which is the whole reason the file is read
 // at all.
 //
-//nolint:paralleltest // ClearEnvForTest uses t.Setenv.
+//nolint:paralleltest // ClearEnv uses t.Setenv.
 func TestLoadDotEnv_AppliesValues(t *testing.T) {
-	config.ClearEnvForTest(t)
+	configtest.ClearEnv(t)
 
 	path := writeDotEnv(t, "# a comment\n"+dotEnvKey+"=from-dot-env\n")
 
@@ -82,9 +83,9 @@ func TestLoadDotEnv_RealEnvironmentWins(t *testing.T) {
 // reverts to its default; the process used to start that way with no
 // log line naming the file at all.
 //
-//nolint:paralleltest // ClearEnvForTest uses t.Setenv.
+//nolint:paralleltest // ClearEnv uses t.Setenv.
 func TestLoadDotEnv_MalformedFileAborts(t *testing.T) {
-	config.ClearEnvForTest(t)
+	configtest.ClearEnv(t)
 
 	path := writeDotEnv(
 		t, malformedDotEnv+dotEnvKey+"=from-dot-env\n",
@@ -132,7 +133,7 @@ func TestLoadDotEnv_UnreadableFileAborts(t *testing.T) {
 //
 //nolint:paralleltest // t.Chdir moves the whole process.
 func TestLoadDotEnv_ReadsTheWorkingDirectory(t *testing.T) {
-	config.ClearEnvForTest(t)
+	configtest.ClearEnv(t)
 
 	dir := t.TempDir()
 	require.NoError(t, os.WriteFile(