Add DB viewer access logging, account deletion, and forced password change

Logs a distinct db_viewer_accessed event (not just the earlier
session_created "requested" event) when an admin's browser actually
completes the hand-off into Adminer. Adds a password-confirmed
account-deletion box to Settings, relying on the existing ON DELETE
CASCADE foreign keys to clean up everything the account owns. Adds an
admin-only "require password change" flag that get_current_user
enforces server-side (403 on everything except /auth/me,
/auth/change-password, /auth/logout) - meant for handing a demo
account to someone with a known sample password.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

apps/web/hooks/use-auth.ts

@@ -5,7 +5,9 @@ import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { ApiError, api, clearTokens, getRefreshToken, setTokens } from "@/lib/api-client";
 import type {
   BanIpPayload,
+  ChangePasswordPayload,
   ConfirmPasswordResetPayload,
+  DeleteAccountPayload,
   LoginPayload,
   RegisterPayload,
   RequestPasswordResetPayload,
@@ -110,6 +112,33 @@ export function useLogout() {
   });
 }
 
+export function useDeleteAccount() {
+  const router = useRouter();
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (payload: DeleteAccountPayload) => api.deleteAccount(payload),
+    onSuccess: () => {
+      // Same reasoning as useLogout: we know for certain the account is
+      // gone, so clear and navigate immediately rather than waiting on a
+      // background refetch of ["me"] to fail.
+      clearTokens();
+      queryClient.clear();
+      router.replace("/");
+    },
+  });
+}
+
+export function useChangePassword() {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (payload: ChangePasswordPayload) => api.changePassword(payload),
+    onSuccess: (tokens) => {
+      setTokens(tokens.access_token, tokens.refresh_token);
+      return queryClient.invalidateQueries({ queryKey: ["me"] });
+    },
+  });
+}
+
 export function useVerifyEmail() {
   return useMutation({
     mutationFn: (payload: VerifyEmailPayload) => api.verifyEmail(payload),