Keep test helpers out of the shipped binary (closes #506)

The test helpers lived in ordinary `testing.go` files inside the config, database, middleware and session packages, so they were built into the binary and the shared `test-support` lint rule could not see them. The four files are gone: the session's helpers move into its own `_test.go` file, and the rest into `configtest`, `databasetest` and `middlewaretest`, which the `depguard` deny list now names, so a non-test file importing them fails lint. The test-support packages build through the production constructors.

Judgement call: the session, the middleware and the webhook database manager now take the plain logger they log through, which the application wiring provides.
Judgement call: two idle-expiry tests move the stored timestamps back instead of advancing a fake clock.

Model: opus-5-5

internal/database/webhook_db_manager_test.go

@@ -18,6 +18,7 @@ import (
 	"gorm.io/gorm"
 	"sneak.berlin/go/webhooker/internal/config"
 	"sneak.berlin/go/webhooker/internal/database"
+	"sneak.berlin/go/webhooker/internal/database/databasetest"
 	"sneak.berlin/go/webhooker/internal/globals"
 	"sneak.berlin/go/webhooker/internal/logger"
 )
@@ -50,7 +51,7 @@ func setupTestWebhookDBManager(
 		lc,
 		database.WebhookDBManagerParams{
 			Config: cfg,
-			Logger: l,
+			Logger: l.Get(),
 		},
 	)
 	require.NoError(t, err)
@@ -117,7 +118,8 @@ func TestWebhookDBManager_ConcurrentFirstTouchOpensOnce(t *testing.T) {
 
 	var logs bytes.Buffer
 
-	mgr := database.NewTestWebhookDBManagerWithLogger(
+	mgr := databasetest.NewWebhookDBManagerWithLogger(
+		t,
 		t.TempDir(),
 		slog.New(slog.NewTextHandler(&logs, nil)),
 	)
@@ -307,7 +309,8 @@ func TestWebhookDBManager_LostDatabaseIsLogged(t *testing.T) {
 
 		var logs bytes.Buffer
 
-		mgr := database.NewTestWebhookDBManagerWithLogger(
+		mgr := databasetest.NewWebhookDBManagerWithLogger(
+			t,
 			t.TempDir(),
 			slog.New(slog.NewTextHandler(&logs, nil)),
 		)