Add DB viewer access logging, account deletion, and forced password change

Logs a distinct db_viewer_accessed event (not just the earlier
session_created "requested" event) when an admin's browser actually
completes the hand-off into Adminer. Adds a password-confirmed
account-deletion box to Settings, relying on the existing ON DELETE
CASCADE foreign keys to clean up everything the account owns. Adds an
admin-only "require password change" flag that get_current_user
enforces server-side (403 on everything except /auth/me,
/auth/change-password, /auth/logout) - meant for handing a demo
account to someone with a known sample password.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

apps/api/app/schemas/auth.py

@@ -73,6 +73,24 @@ class ConfirmPasswordResetRequest(BaseModel):
         return _validate_password_strength(value)
 
 
+class DeleteAccountRequest(BaseModel):
+    password: str = Field(min_length=1, max_length=128)
+
+
+class ChangePasswordRequest(BaseModel):
+    current_password: str = Field(min_length=1, max_length=128)
+    new_password: str = Field(min_length=10, max_length=128)
+
+    @field_validator("new_password")
+    @classmethod
+    def _password_strength(cls, value: str) -> str:
+        return _validate_password_strength(value)
+
+
+class RequirePasswordChangeRequest(BaseModel):
+    email: EmailStr
+
+
 class SecurityEventResponse(BaseModel):
     event_type: str
     ip_address: str

apps/api/app/schemas/user.py

@@ -14,6 +14,7 @@ class UserResponse(BaseModel):
     timezone: str
     is_active: bool
     is_admin: bool
+    must_change_password: bool
 
 
 class MeResponse(UserResponse):