fix: harden admin access, repair ORM joins, and add migration/tests

app/models/item.py

@@ -14,11 +14,13 @@ from sqlalchemy import (
     DateTime,
     Float,
     ForeignKey,
+    ForeignKeyConstraint,
     Index,
     Integer,
     JSON,
     String,
     Text,
+    func,
 )
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
@@ -156,13 +158,13 @@ class Item(Base):
 
     # Timestamps
     created_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), nullable=False, server_default="NOW()"
+        DateTime(timezone=True), nullable=False, server_default=func.now()
     )
     updated_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True),
         nullable=False,
-        server_default="NOW()",
-        onupdate="NOW()",
+        server_default=func.now(),
+        onupdate=func.now(),
     )
 
     # Relationships
@@ -188,6 +190,13 @@ class Item(Base):
 
     # Constraints and indexes
     __table_args__ = (
+        ForeignKeyConstraint(
+            ["website_id", "tryout_id"],
+            ["tryouts.website_id", "tryouts.tryout_id"],
+            name="fk_items_tryout",
+            ondelete="CASCADE",
+            onupdate="CASCADE",
+        ),
         Index(
             "ix_items_tryout_id_website_id_slot",
             "tryout_id",