refactor(db): typed query helpers, shared test FormData helper

Replace raw db.execute tuple casts with queryRows/rowsFrom/execResult/
affectedRows helpers from lib/db, drop redundant mysql2 casts on typed
query builders, and centralize per-test fakeForm into test/fake-form.
Update db mocks in tests so helpers resolve against mocked execute.

src/actions/twofactor.test.ts

@@ -79,32 +79,30 @@ const hoistedUpdateSet = vi.hoisted(() =>
 	vi.fn(() => ({ where: hoistedUpdateWhere })),
 );
 
-vi.mock("@/lib/db", () => ({
-	db: {
-		select: vi.fn(() => ({ from: hoistedSelectFrom })),
-		insert: vi.fn(() => ({ values: hoistedInsertValues })),
-		update: vi.fn(() => ({ set: hoistedUpdateSet })),
-	},
-	User: {
-		id: "user.id",
-		twoFactorSecret: "user.twoFactorSecret",
-		twoFactorConfirmedAt: "user.twoFactorConfirmedAt",
-		twoFactorRecoveryCodes: "user.twoFactorRecoveryCodes",
-	},
-}));
+vi.mock("@/lib/db", () => {
+	return {
+		db: {
+			select: vi.fn(() => ({ from: hoistedSelectFrom })),
+			insert: vi.fn(() => ({ values: hoistedInsertValues })),
+			update: vi.fn(() => ({ set: hoistedUpdateSet })),
+		},
+		User: {
+			id: "user.id",
+			twoFactorSecret: "user.twoFactorSecret",
+			twoFactorConfirmedAt: "user.twoFactorConfirmedAt",
+			twoFactorRecoveryCodes: "user.twoFactorRecoveryCodes",
+		},
+	};
+});
 
 import { db, User } from "@/lib/db";
+import { fakeForm } from "@/test/fake-form";
 import {
 	beginTwoFactor,
 	confirmTwoFactor,
 	disableTwoFactor,
 } from "./twofactor";
 
-const fakeForm = (data: Record<string, string>) =>
-	({
-		get: (key: string) => data[key] ?? null,
-	}) as unknown as FormData;
-
 beforeEach(() => {
 	vi.clearAllMocks();
 	mockAuth.mockResolvedValue({ user: { id: "42" } });