Keep test helpers out of the shipped binary (closes #506)

The test helpers lived in ordinary `testing.go` files inside the config, database, middleware and session packages, so they were built into the binary and the shared `test-support` lint rule could not see them. The four files are gone: the session's helpers move into its own `_test.go` file, and the rest into `configtest`, `databasetest` and `middlewaretest`, which the `depguard` deny list now names, so a non-test file importing them fails lint. The test-support packages build through the production constructors.

Judgement call: the session, the middleware and the webhook database manager now take the plain logger they log through, which the application wiring provides.
Judgement call: two idle-expiry tests move the stored timestamps back instead of advancing a fake clock.

Model: opus-5-5

internal/middleware/metrics.go

@@ -151,7 +151,7 @@ var _ httpmetrics.Recorder = boundedLabelRecorder{}
 
 // Metrics returns middleware that records Prometheus HTTP metrics
 // with the Middleware's one recorder, which New builds on the registry
-// the /metrics route serves and NewForTest on a registry of its own.
+// it is given: in the application, the one the /metrics route serves.
 // Every call reuses that recorder, so any number of routers can
 // install it.
 func (s *Middleware) Metrics() func(http.Handler) http.Handler {