fix(18): make timezone seed idempotent under concurrent race (WR-02)

- Import sql from drizzle-orm in admin.ts
- Add onDuplicateKeyUpdate({ set: { value: sql\`value\` } }) to the
  conditional INSERT in POST /config/timezone/seed so a concurrent seed
  (or seed racing a PUT) cannot 500 on the app_config.key PK constraint
- Existing value is preserved per D-03 no-overwrite (no-op ODKU)
- seeded flag still reflects the pre-flight SELECT (winner: true, loser: false)
- Add tests: 403 access control, seeded:true on first seed, seeded:false
  on second seed without throw (WR-02 idempotent race)

apps/api/tests/routes/admin.test.ts

@@ -704,7 +704,26 @@ describe('admin timezone config', () => {
   // POST /api/admin/config/timezone/seed — seeds when unset (D-02)
   // -------------------------------------------------------------------------
 
-  it('POST seed when unset stores the value and returns ok (D-02)', async () => {
+  // -------------------------------------------------------------------------
+  // POST /api/admin/config/timezone/seed — access control (WR-02)
+  // -------------------------------------------------------------------------
+
+  it('POST seed returns 403 for a non-admin authenticated user (WR-02 access control)', async () => {
+    const nonAdminId = await seedUser('tz-non-admin-seed', false);
+    currentDevUserId = nonAdminId;
+    const app = await getApp();
+
+    const res = await app.fetch(
+      jsonRequest('POST', '/api/admin/config/timezone/seed', { timezone: 'America/Chicago' }),
+    );
+    expect(res.status).toBe(403);
+  });
+
+  // -------------------------------------------------------------------------
+  // POST /api/admin/config/timezone/seed — seeds when unset (D-02)
+  // -------------------------------------------------------------------------
+
+  it('POST seed when unset stores the value and returns { ok: true, seeded: true } (D-02, WR-02)', async () => {
     const adminId = await seedUser('tz-admin-seed-unset', true);
     currentDevUserId = adminId;
     const app = await getApp();
@@ -713,6 +732,10 @@ describe('admin timezone config', () => {
       jsonRequest('POST', '/api/admin/config/timezone/seed', { timezone: 'Europe/London' }),
     );
     expect(res.status).toBe(200);
+    const body = (await res.json()) as { ok: boolean; seeded: boolean };
+    // WR-02: seeded flag must be true when this request performed the seed
+    expect(body.ok).toBe(true);
+    expect(body.seeded).toBe(true);
 
     // Verify the value was stored
     const [row] = await db
@@ -752,4 +775,42 @@ describe('admin timezone config', () => {
       .limit(1);
     expect(row?.value).toBe('America/Chicago');
   });
+
+  // -------------------------------------------------------------------------
+  // POST /api/admin/config/timezone/seed — idempotent under concurrent race (WR-02)
+  // -------------------------------------------------------------------------
+
+  it('POST seed when value already exists returns 200 with seeded:false and does NOT throw (WR-02 idempotent race)', async () => {
+    const adminId = await seedUser('tz-admin-seed-race', true);
+    currentDevUserId = adminId;
+    const app = await getApp();
+
+    // First seed establishes the value (simulates the "winner" of the race)
+    const firstRes = await app.fetch(
+      jsonRequest('POST', '/api/admin/config/timezone/seed', { timezone: 'America/New_York' }),
+    );
+    expect(firstRes.status).toBe(200);
+    const firstBody = (await firstRes.json()) as { ok: boolean; seeded: boolean };
+    expect(firstBody.seeded).toBe(true);
+
+    // Second seed with a different value — simulates the "loser" of the race that
+    // arrives after the row already exists. Pre-fix this would throw a 500 due to
+    // the PK constraint. Post-fix it must return 200 with seeded:false and preserve
+    // the original value (D-03 no-overwrite).
+    const secondRes = await app.fetch(
+      jsonRequest('POST', '/api/admin/config/timezone/seed', { timezone: 'Europe/Paris' }),
+    );
+    expect(secondRes.status).toBe(200);
+    const secondBody = (await secondRes.json()) as { ok: boolean; seeded: boolean };
+    expect(secondBody.ok).toBe(true);
+    expect(secondBody.seeded).toBe(false);
+
+    // The stored value must still be America/New_York (winner's value preserved, D-03)
+    const [row] = await db
+      .select({ value: appConfig.value })
+      .from(appConfig)
+      .where(eq(appConfig.key, 'household_timezone'))
+      .limit(1);
+    expect(row?.value).toBe('America/New_York');
+  });
 });