Show referenced records before deleting an admin account

[MasonMines2006]

Summary

• Closes Accounts tab should show referenced records to manage #224. Deleting an admin account gave no visibility into what it had authored or last touched before the foreign key link was silently nulled out.
• Adds GET /api/admin/accounts/{id}/references, which groups linked records (news, static pages, app config, budget entries, finance hearing settings, calendar events) by type with counts, sample items, and manage-page links.
• Replaces the old window.confirm() delete flow with an AccountReferencesDialog that shows those linked records before an admin confirms deletion, and clearly surfaces a retryable error state if the safety check itself fails (rather than silently treating a failed check as "safe to delete").
• Fixes FinanceHearingConfig.updated_by, the one FK to admin.id that was still NOT NULL with no ondelete rule — it was missed by Admin/Staff roles rework #223's pass over the rest of these and would have thrown an IntegrityError on delete.
• No manual DB migration needed — init_db.py's existing self-healing migration (sync_missing_columns / sync_foreign_key_actions) picks up the nullable + SET NULL change automatically.

Test plan

• Backend: added TestAccountReferences (11 cases covering 404, empty/each reference type, item-limit truncation, staff/unauthenticated access) and a delete test for the FinanceHearingConfig fix; full backend suite passes (634/639 — the 5 unrelated failures are a pre-existing macOS-only /dev/shm pytest config issue, not related to this change).
• Frontend: tsc --noEmit clean, production build passes.
• Manual verification in a live browser (Playwright): confirmed dialog shows linked records per type, confirmed empty-state "safe to delete" message, confirmed error state + disabled delete button + working retry when the references check fails (simulated via request interception).
• Reviewed by code-reviewer and security-reviewer agents; one HIGH finding (failed reference check being indistinguishable from a genuine empty result) was fixed and re-verified live.

[github-actions]

Test Results

642 tests  +15   642 ✅ +15   59s ⏱️ +5s
  1 suites ± 0     0 💤 ± 0 
  1 files   ± 0     0 ❌ ± 0 

Results for commit b7eb56c. ± Comparison against base commit dd856b4.

This pull request removes 1 and adds 16 tests. Note that renamed tests count towards both.

tests.models.test_other_models.TestFinanceHearingConfigModel ‑ test_updated_by_not_nullable

tests.models.test_other_models.TestFinanceHearingConfigModel ‑ test_updated_by_nullable
tests.routes.test_admin_accounts.TestAccountReferences ‑ test_count_exceeds_returned_items
tests.routes.test_admin_accounts.TestAccountReferences ‑ test_empty_when_no_linked_records
tests.routes.test_admin_accounts.TestAccountReferences ‑ test_includes_app_config_updated
tests.routes.test_admin_accounts.TestAccountReferences ‑ test_includes_budget_data_updated
tests.routes.test_admin_accounts.TestAccountReferences ‑ test_includes_calendar_events_created
tests.routes.test_admin_accounts.TestAccountReferences ‑ test_includes_finance_hearing_config_updated
tests.routes.test_admin_accounts.TestAccountReferences ‑ test_includes_news_authored
tests.routes.test_admin_accounts.TestAccountReferences ‑ test_includes_section_membership
tests.routes.test_admin_accounts.TestAccountReferences ‑ test_includes_static_pages_edited
…

♻️ This comment has been updated with latest results.

[calebyhan]

LGTM