fix: harden admin access, repair ORM joins, and add migration/tests

tests/test_model_mappings.py

@@ -0,0 +1,12 @@
+from sqlalchemy.orm import configure_mappers
+
+
+def test_sqlalchemy_mappers_configure_without_join_errors():
+    """
+    Ensure relationship joins are fully resolvable.
+
+    This catches missing FK/primaryjoin regressions early.
+    """
+    import app.models  # noqa: F401
+
+    configure_mappers()