Admin-only database surface.
Every module here is part of the documented sqlx allowlist: the SQL is either user-supplied or built dynamically against runtime-supplied table names, so compile-time verification is impossible.