fix: harden admin access, repair ORM joins, and add migration/tests

app/models/tryout_stats.py

@@ -7,7 +7,17 @@ Maintains running statistics for dynamic normalization and reporting.
 from datetime import datetime
 from typing import Union
 
-from sqlalchemy import CheckConstraint, DateTime, Float, ForeignKey, Index, Integer, String
+from sqlalchemy import (
+    CheckConstraint,
+    DateTime,
+    Float,
+    ForeignKey,
+    ForeignKeyConstraint,
+    Index,
+    Integer,
+    String,
+    func,
+)
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
 from app.database import Base
@@ -107,13 +117,13 @@ class TryoutStats(Base):
         comment="Timestamp of last statistics update",
     )
     created_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), nullable=False, server_default="NOW()"
+        DateTime(timezone=True), nullable=False, server_default=func.now()
     )
     updated_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True),
         nullable=False,
-        server_default="NOW()",
-        onupdate="NOW()",
+        server_default=func.now(),
+        onupdate=func.now(),
     )
 
     # Relationships
@@ -123,6 +133,13 @@ class TryoutStats(Base):
 
     # Constraints and indexes
     __table_args__ = (
+        ForeignKeyConstraint(
+            ["website_id", "tryout_id"],
+            ["tryouts.website_id", "tryouts.tryout_id"],
+            name="fk_tryout_stats_tryout",
+            ondelete="CASCADE",
+            onupdate="CASCADE",
+        ),
         Index(
             "ix_tryout_stats_website_id_tryout_id",
             "website_id",