Keep test helpers out of the shipped binary (closes #506)

The four testing.go files in config, database, middleware and session
are gone. ClearEnvForTest moves to internal/config/configtest as
ClearEnv; the webhook database manager helpers move to
internal/database/databasetest as NewWebhookDBManager and
NewWebhookDBManagerWithLogger, and the middleware's NewForTest to
internal/middleware/middlewaretest as New, both now built through the
production constructors. Tests that wrapped an open main database use
database.Open. The session helpers move into the session package's
export_test.go; the middleware tests build their session through
session.New and age its timestamps instead of using a fake clock.

The session, middleware and webhook database manager now take the
*slog.Logger they log through, so tests in other packages can give
them their own.

Model: opus-5-5

internal/middleware/middleware.go

@@ -22,7 +22,6 @@ import (
 	"sneak.berlin/go/webhooker/internal/config"
 	"sneak.berlin/go/webhooker/internal/globals"
 	"sneak.berlin/go/webhooker/internal/logfield"
-	"sneak.berlin/go/webhooker/internal/logger"
 	"sneak.berlin/go/webhooker/internal/session"
 )
 
@@ -155,7 +154,7 @@ const (
 type MiddlewareParams struct {
 	fx.In
 
-	Logger   *logger.Logger
+	Logger   *slog.Logger
 	Globals  *globals.Globals
 	Config   *config.Config
 	Session  *session.Session
@@ -169,12 +168,10 @@ type Middleware struct {
 	params  *MiddlewareParams
 	session *session.Session
 
-	// metricsRecorder records the inbound HTTP metrics. New builds
-	// it on the registry /metrics serves, NewForTest on a registry
-	// of its own. Either way it is built once per Middleware and
-	// Metrics reuses it, because building it registers its
-	// collectors, and a second registration on the same registry
-	// panics.
+	// metricsRecorder records the inbound HTTP metrics on
+	// params.Registry. It is built once per Middleware and Metrics
+	// reuses it, because building it registers its collectors, and a
+	// second registration on the same registry panics.
 	metricsRecorder httpmetrics.Recorder
 
 	// loginGuard counts failed credential verifications and bounds
@@ -193,7 +190,7 @@ func New(
 ) (*Middleware, error) {
 	s := new(Middleware)
 	s.params = &params
-	s.log = params.Logger.Get()
+	s.log = params.Logger
 	s.session = params.Session
 	s.metricsRecorder = prommetrics.NewRecorder(
 		prommetrics.Config{Registry: params.Registry},