Harden sessions, uploads, admin demotion, and HTTP timeouts.

Address PR review findings: renew session tokens on auth, sniff/re-encode avatars, serialize last-admin checks, bound server timeouts, rune-safe truncation, and TEST_DATABASE_URL-only integration tests.

internal/web/server_test.go

@@ -4,6 +4,8 @@ import (
 	"bytes"
 	"context"
 	"database/sql"
+	"image"
+	"image/png"
 	"mime/multipart"
 	"net/http"
 	"net/http/httptest"
@@ -23,17 +25,14 @@ import (
 
 func testDBURL() string {
 	_ = godotenv.Load()
-	if u := strings.TrimSpace(os.Getenv("TEST_DATABASE_URL")); u != "" {
-		return u
-	}
-	return strings.TrimSpace(os.Getenv("DATABASE_URL"))
+	return strings.TrimSpace(os.Getenv("TEST_DATABASE_URL"))
 }
 
 func newTestServer(t *testing.T, cfg Config) (*Server, *sql.DB) {
 	t.Helper()
 	url := testDBURL()
 	if url == "" {
-		t.Skip("set TEST_DATABASE_URL or DATABASE_URL for web tests")
+		t.Skip("set TEST_DATABASE_URL for web tests")
 	}
 	db, sessions, err := store.OpenPostgres(url, plumber.SchemaSQL)
 	if err != nil {
@@ -162,7 +161,7 @@ func TestRegisterLoginAsk(t *testing.T) {
 func TestSessionSurvivesServerRestart(t *testing.T) {
 	url := testDBURL()
 	if url == "" {
-		t.Skip("set TEST_DATABASE_URL or DATABASE_URL for web tests")
+		t.Skip("set TEST_DATABASE_URL for web tests")
 	}
 	db, sessions, err := store.OpenPostgres(url, plumber.SchemaSQL)
 	if err != nil {
@@ -511,7 +510,10 @@ func TestProfileAdminAnsweredListAndAvatarUpload(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	_, _ = part.Write([]byte("fakepngbytes"))
+	img := image.NewRGBA(image.Rect(0, 0, 1, 1))
+	if err := png.Encode(part, img); err != nil {
+		t.Fatal(err)
+	}
 	_ = w.Close()
 	req = httptest.NewRequest(http.MethodPost, "/profile", &buf)
 	req.Header.Set("Content-Type", w.FormDataContentType())