Add DB viewer access logging, account deletion, and forced password change

Logs a distinct db_viewer_accessed event (not just the earlier
session_created "requested" event) when an admin's browser actually
completes the hand-off into Adminer. Adds a password-confirmed
account-deletion box to Settings, relying on the existing ON DELETE
CASCADE foreign keys to clean up everything the account owns. Adds an
admin-only "require password change" flag that get_current_user
enforces server-side (403 on everything except /auth/me,
/auth/change-password, /auth/logout) - meant for handing a demo
account to someone with a known sample password.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

apps/web/tests/settings-database-viewer.test.tsx

@@ -4,6 +4,10 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 import SettingsPage from "@/app/(app)/settings/page";
 import { renderWithQueryClient } from "./test-utils";
 
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push: vi.fn(), replace: vi.fn() }),
+}));
+
 const ADMIN_USER = {
   id: "user-1",
   email: "[email protected]",
@@ -12,6 +16,7 @@ const ADMIN_USER = {
   is_active: true,
   is_admin: true,
   auth_mode: "jwt",
+  must_change_password: false,
 };
 
 function systemStatusBody(isLocalhost: boolean, authMode: "local" | "jwt") {
@@ -67,7 +72,7 @@ describe("Settings - Database viewer box", () => {
     renderWithQueryClient(<SettingsPage />);
 
     const link = await screen.findByRole("link", { name: /open database viewer/i });
-    expect(link).toHaveAttribute("href", "http://localhost:8081");
+    expect(link).toHaveAttribute("href", "http://localhost:8081/?pgsql=postgres&username=ciagent");
     expect(link).toHaveAttribute("target", "_blank");
   });