harden admin api authorization and add authz regression tests

apps/admin/src/app/api/gyms/[id]/route.ts

@@ -3,6 +3,7 @@ import { auth } from "@clerk/nextjs/server";
 import { eq, sql } from "@fitai/database";
 import { db, users as usersTable, gyms as gymsTable } from "@fitai/database";
 import { ensureUserSynced } from "@/lib/sync-user";
+import { getDatabase } from "@/lib/database";
 import log from "@/lib/logger";
 
 async function ensureGymsTable() {
@@ -33,30 +34,8 @@ export async function DELETE(
       return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
     }
 
-    // Ensure user is synced
-    const currentUser = await ensureUserSynced(userId, {
-      getUserById: async (id: string) => {
-        const row = await db
-          .select()
-          .from(usersTable)
-          .where(eq(usersTable.id, id))
-          .get();
-        return row
-          ? {
-              id: row.id,
-              email: row.email,
-              firstName: row.firstName,
-              lastName: row.lastName,
-              password: row.password ?? "",
-              phone: row.phone ?? undefined,
-              role: row.role,
-              imageUrl: undefined,
-              createdAt: new Date(row.createdAt),
-              updatedAt: new Date(row.updatedAt),
-            }
-          : null;
-      },
-    } as any);
+    const appDb = await getDatabase();
+    const currentUser = await ensureUserSynced(userId, appDb);
 
     // Only superAdmin can delete gyms
     if (!currentUser || currentUser.role !== "superAdmin") {