fix: harden admin access, repair ORM joins, and add migration/tests

app/models/user.py

@@ -6,7 +6,7 @@ Represents users from WordPress that can take tryouts.
 
 from datetime import datetime
 
-from sqlalchemy import DateTime, ForeignKey, Index, String
+from sqlalchemy import DateTime, ForeignKey, Index, String, UniqueConstraint, func
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
 from app.database import Base
@@ -31,7 +31,7 @@ class User(Base):
     id: Mapped[int] = mapped_column(primary_key=True, autoincrement=True)
 
     # WordPress user ID (unique within website context)
-    wp_user_id: Mapped[int] = mapped_column(
+    wp_user_id: Mapped[str] = mapped_column(
         String(255), nullable=False, index=True, comment="WordPress user ID"
     )
 
@@ -44,13 +44,13 @@ class User(Base):
 
     # Timestamps
     created_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), nullable=False, server_default="NOW()"
+        DateTime(timezone=True), nullable=False, server_default=func.now()
     )
     updated_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True),
         nullable=False,
-        server_default="NOW()",
-        onupdate="NOW()",
+        server_default=func.now(),
+        onupdate=func.now(),
     )
 
     # Relationships
@@ -58,12 +58,20 @@ class User(Base):
         "Website", back_populates="users", lazy="selectin"
     )
     sessions: Mapped[list["Session"]] = relationship(
-        "Session", back_populates="user", lazy="selectin", cascade="all, delete-orphan"
+        "Session",
+        back_populates="user",
+        lazy="selectin",
+        cascade="all, delete-orphan",
+        overlaps="sessions,tryout",
     )
 
     # Indexes
     __table_args__ = (
-        Index("ix_users_wp_user_id_website_id", "wp_user_id", "website_id", unique=True),
+        UniqueConstraint(
+            "wp_user_id",
+            "website_id",
+            name="uq_users_wp_user_id_website_id",
+        ),
         Index("ix_users_website_id", "website_id"),
     )