refactor(db): migrate app pages and APIs from Prisma facade to Drizzle (3)

Co-authored-by: Cursor <[email protected]>

src/app/admin/layout.tsx

@@ -1,3 +1,4 @@
+import { eq } from "drizzle-orm";
 import { LogOut } from "lucide-react";
 import Link from "next/link";
 import { redirect } from "next/navigation";
@@ -15,9 +16,9 @@ import {
 	ADMIN_NAV_CONFIG_KEY,
 	parseAdminNavConfig,
 } from "@/lib/admin-nav-config";
+import { db, User } from "@/lib/db";
 import { setCsrfCookie } from "@/lib/foundation/security";
 import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
-import { prisma } from "@/lib/prisma";
 import { siteSettings } from "@/lib/services/site-settings";
 
 // Request-time auth: requireStaff, CSRF cookie, and optional 2FA gate cannot be
@@ -37,11 +38,12 @@ export default async function AdminLayout({
 		csrfToken = "";
 	}
 	if (await siteSettings.getBool("force_staff_2fa", false)) {
-		const u = await prisma.user
-			.findUnique({
-				where: { id: staff.id },
-				select: { twoFactorConfirmedAt: true },
-			})
+		const u = await db
+			.select({ twoFactorConfirmedAt: User.twoFactorConfirmedAt })
+			.from(User)
+			.where(eq(User.id, staff.id))
+			.limit(1)
+			.then((rows) => rows[0] ?? null)
 			.catch(() => null);
 		if (!u?.twoFactorConfirmedAt) redirect("/settings/2fa?error=staffrequired");
 	}