Keep test helpers out of the shipped binary (closes #506)

The four testing.go files in config, database, middleware and session
are gone. ClearEnvForTest moves to internal/config/configtest; the
webhook database manager helpers move to internal/database/databasetest
and the middleware's NewForTest to internal/middleware/middlewaretest,
both now built through the production constructors. Tests that wrapped
an open main database use database.Open. The session helpers move into
the session package's export_test.go; the middleware tests build their
session through session.New and age its timestamps instead of using a
fake clock.

The session, middleware and webhook database manager now take the
*slog.Logger they log through, so tests in other packages can give
them their own.

Model: opus-5-5

internal/session/export_test.go

@@ -16,8 +16,7 @@ func NewStore(key []byte) *sessions.CookieStore {
 }
 
 // NewForTest creates a Session with a pre-configured cookie store for use
-// in tests. This bypasses the fx lifecycle and database dependency, allowing
-// middleware and handler tests to use real session functionality. The key
+// in tests. This bypasses the fx lifecycle and database dependency. The key
 // parameter is the raw 32-byte authentication key used for session encryption
 // and CSRF cookie signing.
 //

internal/session/session.go

@@ -16,7 +16,6 @@ import (
 	"go.uber.org/fx"
 	"sneak.berlin/go/webhooker/internal/config"
 	"sneak.berlin/go/webhooker/internal/database"
-	"sneak.berlin/go/webhooker/internal/logger"
 	"sneak.berlin/go/webhooker/internal/reqtls"
 )
 
@@ -80,7 +79,7 @@ type Params struct {
 
 	Config   *config.Config
 	Database *database.Database
-	Logger   *logger.Logger
+	Logger   *slog.Logger
 }
 
 // Session manages encrypted session storage.
@@ -180,7 +179,7 @@ func New(
 	params Params,
 ) (*Session, error) {
 	s := &Session{
-		log:         params.Logger.Get(),
+		log:         params.Logger,
 		idleTimeout: params.Config.SessionIdleTimeout,
 		now:         time.Now,
 	}