Build the middleware test cookie stores with the production constructor (closes #154)

session.NewStore moves from internal/session/export_test.go into
internal/session/testing.go, so packages outside session can build the
store the application runs with. The two middleware test helpers that
assembled their own store by assigning store.Options now call it, which
puts their securecookie codecs on the same 7-day cap as production
instead of the library's 30-day default.

Model: opus-5-5

internal/middleware/middleware_test.go

@@ -12,7 +12,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/gorilla/sessions"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"sneak.berlin/go/webhooker/internal/config"
@@ -78,14 +77,7 @@ func newTestSessionManager(
 		key[i] = byte(i)
 	}
 
-	store := sessions.NewCookieStore(key)
-	store.Options = &sessions.Options{
-		Path:     "/",
-		MaxAge:   86400 * 7,
-		HttpOnly: true,
-		Secure:   false,
-		SameSite: http.SameSiteLaxMode,
-	}
+	store := session.NewStore(key)
 
 	var now func() time.Time
 
@@ -931,8 +923,7 @@ func metricsAuthMiddleware(
 	}
 
 	key := make([]byte, testKeySize)
-	store := sessions.NewCookieStore(key)
-	store.Options = &sessions.Options{Path: "/", MaxAge: 86400}
+	store := session.NewStore(key)
 
 	sessManager := session.NewForTest(store, cfg, log, key, nil)