refactor(db): typed query helpers, shared test FormData helper

Replace raw db.execute tuple casts with queryRows/rowsFrom/execResult/
affectedRows helpers from lib/db, drop redundant mysql2 casts on typed
query builders, and centralize per-test fakeForm into test/fake-form.
Update db mocks in tests so helpers resolve against mocked execute.

src/app/admin/permissions/page.tsx

@@ -2,7 +2,7 @@ import { sql } from "drizzle-orm";
 import { redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import Link from "@/components/link";
-import { db } from "@/lib/db";
+import { db, queryRows } from "@/lib/db";
 import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 import { fetchEmulatorRankSummaries } from "@/lib/services/permission-ranks";
 import { PermissionsList } from "./permissions-list";
@@ -25,9 +25,9 @@ export default async function PermissionsPage({
 	const ranks = await fetchEmulatorRankSummaries(db);
 
 	// User counts per rank
-	const [rawCounts] = (await db.execute(
+	const rawCounts = await queryRows<{ rank: number; cnt: number }>(
 		sql`SELECT \`rank\`, COUNT(*) as cnt FROM users GROUP BY \`rank\``,
-	)) as unknown as [{ rank: number; cnt: number }[], unknown[]];
+	);
 	const countMap: Record<number, number> = {};
 	for (const row of rawCounts) {
 		countMap[Number(row.rank)] = Number(row.cnt);

src/app/admin/permissions/preview/page.test.tsx

@@ -2,7 +2,10 @@ import { renderToStaticMarkup } from "react-dom/server";
 import { beforeEach, expect, it, vi } from "vitest";
 
 const state = vi.hoisted(() => ({ access: vi.fn(), execute: vi.fn() }));
-vi.mock("@/lib/db", () => ({ db: { execute: state.execute } }));
+vi.mock("@/lib/db", async () => ({
+	...(await import("@/test/db-helpers")).createDbHelpers(state.execute),
+	db: { execute: state.execute },
+}));
 vi.mock("@/lib/permissions", () => ({
 	PERMS: { PERMISSIONS_MANAGE: "admin.permissions.manage" },
 	getAdminContext: async () => ({

src/app/admin/permissions/preview/page.tsx

@@ -4,7 +4,7 @@ import { getTranslations } from "next-intl/server";
 import Link from "@/components/link";
 import { isDynamicSuperAdmin } from "@/lib/admin/authorization-policy";
 import { previewRoleAccess } from "@/lib/admin/permission-preview";
-import { db } from "@/lib/db";
+import { queryRows } from "@/lib/db";
 import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 
 export default async function PermissionPreview({
@@ -17,14 +17,11 @@ export default async function PermissionPreview({
 		redirect("/admin");
 	const t = await getTranslations("pages.admin.permissionPreview");
 	const nav = await getTranslations("pages.admin.nav");
-	const [roleRows] = await db.execute(
-		sql`SELECT id, slug, title FROM acl_roles ORDER BY title, id`,
-	);
-	const roles = roleRows as unknown as {
+	const roles = await queryRows<{
 		id: number;
 		slug: string;
 		title: string;
-	}[];
+	}>(sql`SELECT id, slug, title FROM acl_roles ORDER BY title, id`);
 	const params = await searchParams;
 	const selected =
 		roles.find((r) => String(r.id) === params.role) ??
@@ -33,15 +30,13 @@ export default async function PermissionPreview({
 	let superAdmin = false;
 	let permissionTitles: Record<string, string> = {};
 	if (selected) {
-		const [grantRows] = await db.execute(
+		const grants = await queryRows<{ slug: string; title: string }>(
 			sql`SELECT p.slug, p.title FROM acl_model_permissions mp JOIN acl_permissions p ON p.id = mp.permission_id WHERE mp.model_type = 'Role' AND mp.model_id = ${selected.id}`,
 		);
-		const grants = grantRows as unknown as { slug: string; title: string }[];
-		const [highestRows] = await db.execute(
-			sql`SELECT COALESCE((SELECT MAX(u.\`rank\`) FROM users u INNER JOIN permission_ranks pr ON pr.id = u.\`rank\`), (SELECT MAX(id) FROM permission_ranks)) AS highest_rank`,
-		);
 		const highest = (
-			highestRows as unknown as { highest_rank: number | null }[]
+			await queryRows<{ highest_rank: number | null }>(
+				sql`SELECT COALESCE((SELECT MAX(u.\`rank\`) FROM users u INNER JOIN permission_ranks pr ON pr.id = u.\`rank\`), (SELECT MAX(id) FROM permission_ranks)) AS highest_rank`,
+			)
 		)[0]?.highest_rank;
 		const rankMatch = /^rank_([1-9]\d*)$/.exec(selected.slug);
 		superAdmin =
@@ -54,14 +49,11 @@ export default async function PermissionPreview({
 			grants.map((g) => g.slug),
 			superAdmin,
 		);
-		const [allRows] = await db.execute(
+		const allRows = await queryRows<{ slug: string; title: string }>(
 			sql`SELECT slug, title FROM acl_permissions ORDER BY slug`,
 		);
 		permissionTitles = Object.fromEntries(
-			(allRows as unknown as { slug: string; title: string }[]).map((p) => [
-				p.slug,
-				p.title,
-			]),
+			allRows.map((p) => [p.slug, p.title]),
 		);
 	}
 	return (