Add DB viewer access logging, account deletion, and forced password change

Logs a distinct db_viewer_accessed event (not just the earlier
session_created "requested" event) when an admin's browser actually
completes the hand-off into Adminer. Adds a password-confirmed
account-deletion box to Settings, relying on the existing ON DELETE
CASCADE foreign keys to clean up everything the account owns. Adds an
admin-only "require password change" flag that get_current_user
enforces server-side (403 on everything except /auth/me,
/auth/change-password, /auth/logout) - meant for handing a demo
account to someone with a known sample password.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

apps/api/app/models/enums.py

@@ -154,6 +154,9 @@ class SecurityEventType(StrEnum):
     SERVER_SECRET_UPDATED = "server_secret_updated"
     API_KEY_UPDATED = "api_key_updated"
     DB_VIEWER_SESSION_CREATED = "db_viewer_session_created"
+    DB_VIEWER_ACCESSED = "db_viewer_accessed"
+    PASSWORD_CHANGED = "password_changed"
+    PASSWORD_CHANGE_REQUIRED = "password_change_required"
 
 
 class ApiKeyProvider(StrEnum):

apps/api/app/models/user.py

@@ -42,6 +42,12 @@ class User(Base, UUIDPrimaryKeyMixin, TimestampMixin):
     failed_login_count: Mapped[int] = mapped_column(Integer, default=0)
     locked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
 
+    # Admin-forced reset (e.g. before handing a demo account to someone) -
+    # see app.auth.dependencies.get_current_user, which blocks every
+    # endpoint except /auth/me, /auth/change-password, and /auth/logout
+    # while this is true.
+    must_change_password: Mapped[bool] = mapped_column(Boolean, default=False)
+
     refresh_tokens: Mapped[list[RefreshToken]] = relationship(
         back_populates="user", cascade="all, delete-orphan"
     )