Keep test helpers out of the shipped binary (closes #506)

The four testing.go files in config, database, middleware and session
are gone. ClearEnvForTest moves to internal/config/configtest; the
webhook database manager helpers move to internal/database/databasetest
and the middleware's NewForTest to internal/middleware/middlewaretest,
both now built through the production constructors. Tests that wrapped
an open main database use database.Open. The session helpers move into
the session package's export_test.go; the middleware tests build their
session through session.New and age its timestamps instead of using a
fake clock.

The session, middleware and webhook database manager now take the
*slog.Logger they log through, so tests in other packages can give
them their own.

Model: opus-5-5

internal/handlers/profile_test.go

@@ -15,7 +15,7 @@ import (
 	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/logger"
-	"sneak.berlin/go/webhooker/internal/middleware"
+	"sneak.berlin/go/webhooker/internal/middleware/middlewaretest"
 	"sneak.berlin/go/webhooker/internal/session"
 )
 
@@ -135,7 +135,7 @@ func TestUserRoute_Unauthenticated_RedirectedByMiddleware(t *testing.T) {
 
 	t.Cleanup(app.RequireStop)
 
-	mw := middleware.NewForTest(log.Get(), cfg, sess)
+	mw := middlewaretest.NewForTest(t, log.Get(), cfg, sess)
 
 	var handlerReached bool