Add DB viewer access logging, account deletion, and forced password change

Logs a distinct db_viewer_accessed event (not just the earlier
session_created "requested" event) when an admin's browser actually
completes the hand-off into Adminer. Adds a password-confirmed
account-deletion box to Settings, relying on the existing ON DELETE
CASCADE foreign keys to clean up everything the account owns. Adds an
admin-only "require password change" flag that get_current_user
enforces server-side (403 on everything except /auth/me,
/auth/change-password, /auth/logout) - meant for handing a demo
account to someone with a known sample password.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

apps/web/app/(app)/layout.tsx

@@ -15,6 +15,7 @@ export default function DashboardLayout({ children }: { children: React.ReactNod
   const logout = useLogout();
 
   const requiresLogin = systemStatus ? !isLocalConvenience(systemStatus) : false;
+  const mustChangePassword = user?.must_change_password ?? false;
 
   useEffect(() => {
     if (requiresLogin && !isLoading && isError) {
@@ -22,6 +23,12 @@ export default function DashboardLayout({ children }: { children: React.ReactNod
     }
   }, [requiresLogin, isLoading, isError, router]);
 
+  useEffect(() => {
+    if (mustChangePassword) {
+      router.replace("/change-password");
+    }
+  }, [mustChangePassword, router]);
+
   if (requiresLogin && (isLoading || isError)) {
     return (
       <div className="flex min-h-screen items-center justify-center text-sm text-slate-500">
@@ -30,6 +37,17 @@ export default function DashboardLayout({ children }: { children: React.ReactNod
     );
   }
 
+  // Every API call except /auth/me, /auth/change-password, and /auth/logout
+  // 403s server-side while this is set (app/auth/dependencies.py) - this is
+  // just the matching frontend redirect, not the actual enforcement.
+  if (mustChangePassword) {
+    return (
+      <div className="flex min-h-screen items-center justify-center text-sm text-slate-500">
+        Redirecting…
+      </div>
+    );
+  }
+
   return (
     <div className="min-h-screen bg-slate-50">
       <LocalModeBanner />