feat: move MockLogger into a logtest sub-package

NewMockLogger/MockLogger move from the main `logging` package to a new
`logging/logtest` sub-package, so the production `logging` package's import
graph no longer pulls in testify — only consumers that import logtest do.
testify stays in the module's go.mod (used by logtest and the library's own
tests).

Breaking import change for consumers: `logging.NewMockLogger` becomes
`logtest.NewMockLogger`. The backend services that reference it are updated to
the logtest import alongside their go.mod bump to this release.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -38,7 +38,9 @@ handler = logmw.RequestLogger(logger)(handler)
 In tests:
 
 ```go
-m := logging.NewMockLogger()
+import logtest "gitea.unbound.se/shiny/logging/logtest"
+
+m := logtest.NewMockLogger()
 // ... exercise code with m.Logger() ...
 m.Check(t, []string{"level=INFO msg=\"...\""})
 ```
@@ -47,16 +49,15 @@ m.Check(t, []string{"level=INFO msg=\"...\""})
 
 - `SetupLogger(logLevel, logFormat, serviceName, buildVersion string) *slog.Logger`
 - `ContextWithLogger(ctx, *slog.Logger) context.Context` / `LoggerFromContext(ctx) *slog.Logger`
-- `Logger` interface; `NewMockLogger() *MockLogger` (+ `MockLogger.Logger()`, `MockLogger.Check(t, want)`).
+- `logging/logtest.NewMockLogger() *MockLogger` (+ `MockLogger.Logger()`, `MockLogger.Check(t, want)`) — the test helper, in its own sub-package so production code doesn't pull in testify.
 - `logging/middleware.RequestLogger(logger) func(http.Handler) http.Handler`.
 
 ### Notes
 
-- `MockLogger` currently lives in the main package, so `testify` is a non-test
-  dependency of the module. Moving it to a `logging/logtest` sub-package is a
-  tracked low-priority follow-up — it's a breaking import change for the ~13
-  services that reference `logging.NewMockLogger`, so it is deferred until a
-  coordinated bump (Ambix 019ecabc).
+- `MockLogger`/`NewMockLogger` live in the `logging/logtest` sub-package, so the
+  production `logging` package's import graph is free of `testify` — consumers
+  only compile it if they import `logtest`. (`testify` stays in the module's
+  `go.mod` because `logtest` and the library's own tests use it.)
 
 ### Conventions