fix: harden admin access, repair ORM joins, and add migration/tests

app/models/tryout.py

@@ -7,7 +7,17 @@ Represents tryout exams with configurable scoring, selection, and normalization
 from datetime import datetime
 from typing import Literal, Union
 
-from sqlalchemy import Boolean, CheckConstraint, DateTime, Float, ForeignKey, Index, Integer, String
+from sqlalchemy import (
+    Boolean,
+    CheckConstraint,
+    DateTime,
+    Float,
+    ForeignKey,
+    Integer,
+    String,
+    UniqueConstraint,
+    func,
+)
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
 from app.database import Base
@@ -146,13 +156,13 @@ class Tryout(Base):
 
     # Timestamps
     created_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), nullable=False, server_default="NOW()"
+        DateTime(timezone=True), nullable=False, server_default=func.now()
     )
     updated_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True),
         nullable=False,
-        server_default="NOW()",
-        onupdate="NOW()",
+        server_default=func.now(),
+        onupdate=func.now(),
     )
 
     # Relationships
@@ -163,7 +173,11 @@ class Tryout(Base):
         "Item", back_populates="tryout", lazy="selectin", cascade="all, delete-orphan"
     )
     sessions: Mapped[list["Session"]] = relationship(
-        "Session", back_populates="tryout", lazy="selectin", cascade="all, delete-orphan"
+        "Session",
+        back_populates="tryout",
+        lazy="selectin",
+        cascade="all, delete-orphan",
+        overlaps="user",
     )
     stats: Mapped["TryoutStats"] = relationship(
         "TryoutStats", back_populates="tryout", lazy="selectin", uselist=False
@@ -171,8 +185,10 @@ class Tryout(Base):
 
     # Constraints and indexes
     __table_args__ = (
-        Index(
-            "ix_tryouts_website_id_tryout_id", "website_id", "tryout_id", unique=True
+        UniqueConstraint(
+            "website_id",
+            "tryout_id",
+            name="uq_tryouts_website_id_tryout_id",
         ),
         CheckConstraint("min_sample_for_dynamic > 0", "ck_min_sample_positive"),
         CheckConstraint("static_rataan > 0", "ck_static_rataan_positive"),