Add DB viewer access logging, account deletion, and forced password change

Logs a distinct db_viewer_accessed event (not just the earlier
session_created "requested" event) when an admin's browser actually
completes the hand-off into Adminer. Adds a password-confirmed
account-deletion box to Settings, relying on the existing ON DELETE
CASCADE foreign keys to clean up everything the account owns. Adds an
admin-only "require password change" flag that get_current_user
enforces server-side (403 on everything except /auth/me,
/auth/change-password, /auth/logout) - meant for handing a demo
account to someone with a known sample password.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

apps/web/lib/api-client.ts

@@ -10,8 +10,10 @@ import type {
   CompanyResponse,
   CompanyUpdatePayload,
   ConfirmPasswordResetPayload,
+  ChangePasswordPayload,
   DashboardAnalytics,
   DbViewerSessionResponse,
+  DeleteAccountPayload,
   DiscoverCompanyRequest,
   DiscoveredCompanyProfile,
   IpBan,
@@ -205,6 +207,18 @@ export const api = {
 
   me: () => request<MeResponse>("/api/v1/auth/me"),
 
+  deleteAccount: (payload: DeleteAccountPayload) =>
+    request<void>("/api/v1/auth/me", {
+      method: "DELETE",
+      body: JSON.stringify(payload),
+    }),
+
+  changePassword: (payload: ChangePasswordPayload) =>
+    request<TokenResponse>("/api/v1/auth/change-password", {
+      method: "POST",
+      body: JSON.stringify(payload),
+    }),
+
   verifyEmail: (payload: VerifyEmailPayload) =>
     request<void>("/api/v1/auth/verify-email", {
       method: "POST",

apps/web/lib/types.ts

@@ -33,6 +33,15 @@ export interface DbViewerSessionResponse {
   token: string;
 }
 
+export interface DeleteAccountPayload {
+  password: string;
+}
+
+export interface ChangePasswordPayload {
+  current_password: string;
+  new_password: string;
+}
+
 export interface SetSystemSecretPayload {
   value: string;
 }
@@ -70,6 +79,7 @@ export interface UserResponse {
   timezone: string;
   is_active: boolean;
   is_admin: boolean;
+  must_change_password: boolean;
 }
 
 export interface MeResponse extends UserResponse {