Make web tests database-free and finish review hardening.

Introduce a Store interface with Postgres and in-memory backends, cover mutations/CSRF/session rotation without Postgres, bound avatar decode dimensions, add truncate/prepareAvatar unit tests, and run go test -race in CI.

internal/store/postgres_store.go

@@ -0,0 +1,86 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+)
+
+// Postgres implements Store against a sqlc-backed database.
+type Postgres struct {
+	db *sql.DB
+}
+
+// NewPostgres wraps db as a Store.
+func NewPostgres(db *sql.DB) *Postgres {
+	return &Postgres{db: db}
+}
+
+func (p *Postgres) CreateUser(ctx context.Context, u *User) error {
+	u.db = p.db
+	return u.Create(ctx)
+}
+
+func (p *Postgres) UserByID(ctx context.Context, id string) (*User, error) {
+	return UserByID(ctx, p.db, id)
+}
+
+func (p *Postgres) UserByUsername(ctx context.Context, username string) (*User, error) {
+	return UserByUsername(ctx, p.db, username)
+}
+
+func (p *Postgres) ListUsers(ctx context.Context) ([]User, error) {
+	return ListUsers(ctx, p.db)
+}
+
+func (p *Postgres) CountAdmins(ctx context.Context) (int, error) {
+	return CountAdmins(ctx, p.db)
+}
+
+func (p *Postgres) SetUserRole(ctx context.Context, id string, role Role) error {
+	u := &User{ID: id, db: p.db}
+	return u.SetRole(ctx, role)
+}
+
+func (p *Postgres) SaveUserProfile(ctx context.Context, u *User) error {
+	u.db = p.db
+	return u.SaveProfile(ctx)
+}
+
+func (p *Postgres) CreateQuestion(ctx context.Context, q *RankedQuestion) error {
+	q.db = p.db
+	return q.Create(ctx)
+}
+
+func (p *Postgres) GetQuestion(ctx context.Context, id, viewerID string) (*RankedQuestion, error) {
+	return GetQuestion(ctx, p.db, id, viewerID)
+}
+
+func (p *Postgres) ListHunt(ctx context.Context, huntDate, viewerID string) ([]RankedQuestion, error) {
+	return ListHunt(ctx, p.db, huntDate, viewerID)
+}
+
+func (p *Postgres) ListQuestionsByAuthor(ctx context.Context, authorID string) ([]RankedQuestion, error) {
+	return ListQuestionsByAuthor(ctx, p.db, authorID)
+}
+
+func (p *Postgres) ListQuestionsAnsweredBy(ctx context.Context, adminID string) ([]RankedQuestion, error) {
+	return ListQuestionsAnsweredBy(ctx, p.db, adminID)
+}
+
+func (p *Postgres) HideQuestion(ctx context.Context, id string) error {
+	q := &RankedQuestion{ID: id, db: p.db}
+	return q.Hide(ctx)
+}
+
+func (p *Postgres) GetAnswer(ctx context.Context, questionID string) (*Answer, error) {
+	return GetAnswer(ctx, p.db, questionID)
+}
+
+func (p *Postgres) UpsertAnswer(ctx context.Context, a *Answer) error {
+	a.db = p.db
+	return a.Upsert(ctx)
+}
+
+func (p *Postgres) Vote(ctx context.Context, userID, questionID string, value int) error {
+	return Vote(ctx, p.db, userID, questionID, value)
+}