fix: harden admin access, repair ORM joins, and add migration/tests

app/routers/tryouts.py

@@ -10,7 +10,7 @@ Endpoints:
 from typing import List, Optional
 
 from fastapi import APIRouter, Depends, HTTPException, Header, status
-from sqlalchemy import select, func
+from sqlalchemy import Integer, cast, func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import selectinload
 
@@ -292,7 +292,7 @@ async def get_calibration_status(
     stats_result = await db.execute(
         select(
             func.count().label("total_items"),
-            func.sum(func.cast(Item.calibrated, type_=func.INTEGER)).label("calibrated_items"),
+            func.sum(cast(Item.calibrated, Integer)).label("calibrated_items"),
             func.avg(Item.calibration_sample_size).label("avg_sample_size"),
         ).where(
             Item.website_id == website_id,