Keep test helpers out of the shipped binary (closes #506)

The test helpers lived in ordinary `testing.go` files inside the config, database, middleware and session packages, so they were built into the binary and the shared `test-support` lint rule could not see them. The four files are gone: the session's helpers move into its own `_test.go` file, and the rest into `configtest`, `databasetest` and `middlewaretest`, which the `depguard` deny list now names, so a non-test file importing them fails lint. The test-support packages build through the production constructors.

Judgement call: the session, the middleware and the webhook database manager now take the plain logger they log through, which the application wiring provides.
Judgement call: two idle-expiry tests move the stored timestamps back instead of advancing a fake clock.

Model: opus-5-5

internal/handlers/target_download_test.go

@@ -24,7 +24,7 @@ import (
 	"sneak.berlin/go/webhooker/internal/config"
 	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/delivery"
-	"sneak.berlin/go/webhooker/internal/middleware"
+	"sneak.berlin/go/webhooker/internal/middleware/middlewaretest"
 )
 
 // errClientGone is the write failure of a client that has gone away.
@@ -310,7 +310,8 @@ func limitedServer(
 	const sendBuffer = 4 << 10
 
 	logBuf := new(bytes.Buffer)
-	mw := middleware.NewForTest(
+	mw := middlewaretest.New(
+		t,
 		slog.New(slog.NewJSONHandler(logBuf, nil)),
 		&config.Config{Environment: config.EnvironmentDev},
 		nil,