refactor(db): typed query helpers, shared test FormData helper

Replace raw db.execute tuple casts with queryRows/rowsFrom/execResult/
affectedRows helpers from lib/db, drop redundant mysql2 casts on typed
query builders, and centralize per-test fakeForm into test/fake-form.
Update db mocks in tests so helpers resolve against mocked execute.

src/lib/permissions.ts

@@ -6,7 +6,7 @@ import { isDynamicSuperAdmin } from "./admin/authorization-policy";
 import { resolveAuthorizationState } from "./admin/rank-authority";
 import { auth } from "./auth";
 import { sessionUserId } from "./auth/session-user";
-import { db, User } from "./db";
+import { db, queryRows, User } from "./db";
 import { redirectSafe } from "./foundation/security";
 
 // Re-export PERMS from the standalone file (safe for client components)
@@ -33,7 +33,7 @@ function createEmptySet(): PermissionSet {
  */
 const getCachedPermissionSlugs = unstable_cache(
 	async (userId: number, rank: number): Promise<string[]> => {
-		const [result] = await db.execute<{ slug: string }>(sql`
+		const rows = await queryRows<{ slug: string }>(sql`
       SELECT DISTINCT p.slug
       FROM acl_model_permissions mp
       JOIN acl_permissions p ON p.id = mp.permission_id
@@ -48,7 +48,6 @@ const getCachedPermissionSlugs = unstable_cache(
           WHERE ar.slug = ${`rank_${rank}`}
         )
     `);
-		const rows = result as unknown as { slug: string }[];
 		return rows.map((r) => r.slug);
 	},
 	["user-permissions"],
@@ -120,7 +119,7 @@ const getCurrentAuthorizationState = cache(async (userId: number) =>
 			// Prefer the highest rank actually held by a user. Unused high IDs in
 			// permission_ranks (common on Habbo DBs) would otherwise lock the real
 			// owner out of super-admin / permissions management.
-			const [result] = await db.execute<{
+			const rows = await queryRows<{
 				highest_rank: number | bigint | null;
 			}>(sql`
         SELECT COALESCE(
@@ -132,9 +131,6 @@ const getCurrentAuthorizationState = cache(async (userId: number) =>
           (SELECT MAX(id) FROM permission_ranks)
         ) AS highest_rank
       `);
-			const rows = result as unknown as {
-				highest_rank: number | bigint | null;
-			}[];
 			return rows[0]?.highest_rank == null
 				? null
 				: Number(rows[0].highest_rank);