remove the runtime test_mode switch; the testmode build tag is the only one

server.test_mode survived the build-tag refactor only to feed five
behavioral branches: the registry's fall-back to the default hold when
the user's hold is unreachable, backfill warning suppression for
external holds, the appview listener close on shutdown, the hold's
relay-crawl skip, and the hold's appview-issuer tolerance. Every one of
them is a "this is a local development build" decision, which is what
the tag already says, and local development has to build with the tag
or nothing resolves. So they read atproto.TestModeBuild now, and the
flag, SetTestMode, IsTestMode, the middleware option, the backfill
constructor parameter, the never-read field on RemoteHoldAuthorizer,
the example and template YAML lines, and the docker-compose env vars
are gone. The registry keeps the fallback as a field seeded from the
constant so the production-path tests can pin it off under the tag.

The 24 SetTestMode calls in tests were dead already: stripping them and
running the affected packages tagged changed nothing.

Tests that resolve a loopback did:web used to t.Fatal naming the tag,
which left a bare `go test ./...` permanently red in five packages.
They now live under `//go:build testmode`: whole-file constraints where
every test needs it, and sibling *_testmode_test.go files holding the
moved tests plus their fixtures where a file mixed. The harness carries
the constraint too, with its package doc in an untagged doc.go so the
package still exists without it. An untagged run compiles those tests
out and passes; make test keeps the tag and runs everything.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UwYzaG3Yy7uA8FbZ5qk3tQ

deploy/upcloud/configs/appview.yaml.tmpl

@@ -11,7 +11,6 @@ server:
     addr: :5000
     base_url: "https://seamark.dev"
     client_name: Seamark
-    test_mode: false
     client_short_name: Seamark
     registry_domains:
       - "buoy.cr"

deploy/upcloud/configs/hold.yaml.tmpl

@@ -19,7 +19,6 @@ server:
     public_url: "https://{{.HoldDomain}}"
     public: false
     successor: ""
-    test_mode: false
     relay_endpoints:
         - https://relay1.us-east.bsky.network
         - https://relay1.us-west.bsky.network