Keep test helpers out of the shipped binary (closes #506)

The four testing.go files in config, database, middleware and session
are gone. ClearEnvForTest moves to internal/config/configtest as
ClearEnv; the webhook database manager helpers move to
internal/database/databasetest as NewWebhookDBManager and
NewWebhookDBManagerWithLogger, and the middleware's NewForTest to
internal/middleware/middlewaretest as New, both now built through the
production constructors. Tests that wrapped an open main database use
database.Open. The session helpers move into the session package's
export_test.go; the middleware tests build their session through
session.New and age its timestamps instead of using a fake clock.

The session, middleware and webhook database manager now take the
*slog.Logger they log through, so tests in other packages can give
them their own.

Model: opus-5-5

internal/middleware/accesslog_test.go

@@ -16,6 +16,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"sneak.berlin/go/webhooker/internal/config"
 	"sneak.berlin/go/webhooker/internal/middleware"
+	"sneak.berlin/go/webhooker/internal/middleware/middlewaretest"
 )
 
 // floodRequests is the number of distinct invented paths each flood
@@ -83,7 +84,7 @@ func capturingMiddleware(t *testing.T) (*middleware.Middleware, *bytes.Buffer) {
 		TrustedProxies: trustedProxies("192.0.2.1/32"),
 	}
 
-	return middleware.NewForTest(log, cfg, nil), buf
+	return middlewaretest.New(t, log, cfg, nil), buf
 }
 
 // capturingTextMiddleware is capturingMiddleware for the other handler
@@ -107,7 +108,7 @@ func capturingTextMiddleware(
 		TrustedProxies: trustedProxies("192.0.2.1/32"),
 	}
 
-	return middleware.NewForTest(log, cfg, nil), buf
+	return middlewaretest.New(t, log, cfg, nil), buf
 }
 
 // accessLogRouter mirrors the production route shapes that an