Fix admin authorization and harden chat requests

src/db/schema.js

@@ -10,6 +10,7 @@ export function initializeSchema(db) {
         (
             username TEXT PRIMARY KEY,
             password TEXT NOT NULL,
+            role TEXT NOT NULL DEFAULT 'user' CHECK (role IN ('user', 'admin')),
             session_version INTEGER DEFAULT 0
         )
     `).run();
@@ -256,6 +257,7 @@ export function runMigrations(db, {dropLegacyChats = true} = {}) {
     };
 
     const userColumns = db.prepare("PRAGMA table_info(users)").all();
+    ensureColumn("users", userColumns, "role", "ALTER TABLE users ADD COLUMN role TEXT NOT NULL DEFAULT 'user' CHECK (role IN ('user', 'admin'))");
     ensureColumn("users", userColumns, "session_version", "ALTER TABLE users ADD COLUMN session_version INTEGER DEFAULT 0");
     db.prepare("UPDATE users SET session_version = 0 WHERE session_version IS NULL").run();