refactor(db): typed query helpers, shared test FormData helper

Replace raw db.execute tuple casts with queryRows/rowsFrom/execResult/
affectedRows helpers from lib/db, drop redundant mysql2 casts on typed
query builders, and centralize per-test fakeForm into test/fake-form.
Update db mocks in tests so helpers resolve against mocked execute.

src/actions/admin-vpn.test.ts

@@ -2,6 +2,7 @@ import { redirect } from "next/navigation";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import { requirePermission } from "@/lib/admin/guard";
 import { siteSettings } from "@/lib/services/site-settings";
+import { fakeForm } from "@/test/fake-form";
 import { saveVpn } from "./admin-vpn";
 
 const { mockValues, mockOnDuplicateKeyUpdate } = vi.hoisted(() => {
@@ -30,10 +31,6 @@ vi.mock("next/cache", () => ({ revalidatePath: vi.fn() }));
 vi.mock("next/navigation", () => ({ redirect: vi.fn() }));
 
 const staff = { id: 1, rank: 7, username: "admin" };
-const fakeForm = (data: Record<string, string | null>) => ({
-	get: (key: string) => (key in data ? data[key] : null),
-});
-
 beforeEach(() => {
 	vi.clearAllMocks();
 	vi.mocked(requirePermission).mockResolvedValue(staff as never);
@@ -50,7 +47,7 @@ describe("saveVpn", () => {
 				vpn_block_enabled: "1",
 				vpn_provider: "proxycheck",
 				vpn_api_key: "abc123",
-			}) as unknown as FormData,
+			}) as FormData,
 		);
 		expect(mockValues).toHaveBeenCalledTimes(4);
 		expect(mockOnDuplicateKeyUpdate).toHaveBeenCalledTimes(4);