Fix norawsql lint: move PRAGMA foreign_keys into dbtest helper

Extract EnableForeignKeys helper into dbtest package (which is in the
norawsql allow-list) and add CreateBaseDBWithFK to testutil for reuse.

Author: ElecTwix

packages/db/pkg/dbtest/linux.go

@@ -32,6 +32,14 @@ func GetTestDB(ctx context.Context) (*sql.DB, error) {
 	return db, nil
 }
 
+// EnableForeignKeys enables SQLite foreign key enforcement on db. It must be
+// called after SetMaxOpenConns(1) so the PRAGMA applies to every connection.
+// PRAGMA is a SQLite connection directive — there is no sqlc-generated equivalent.
+func EnableForeignKeys(ctx context.Context, db *sql.DB) error {
+	_, err := db.ExecContext(ctx, "PRAGMA foreign_keys = ON")
+	return err
+}
+
 func GetTestPreparedQueries(ctx context.Context) (*gen.Queries, error) {
 	// Generate unique database name for this test to ensure isolation
 	uniqueName := ulid.Make().String()

packages/db/pkg/dbtest/windows.go

@@ -13,6 +13,11 @@ func GetTestDB(ctx context.Context) (*sql.DB, error) {
 	return nil, errors.New("not implemented")
 }
 
+// EnableForeignKeys is not implemented on Windows.
+func EnableForeignKeys(_ context.Context, _ *sql.DB) error {
+	return errors.New("not implemented")
+}
+
 func GetTestPreparedQueries(ctx context.Context) (*gen.Queries, error) {
 	return nil, errors.New("not implemented")
 }

packages/server/internal/api/rauthadapter/rauthadapter_test.go

@@ -25,16 +25,10 @@ func newHandler(t *testing.T) (AuthAdapterRPC, func()) {
 
 // newHandlerWithFK is like newHandler but enables SQLite FK enforcement so that
 // ON DELETE CASCADE constraints fire. Tests that rely on DB-level cascade must
-// use this variant. PRAGMA foreign_keys is per-connection; SetMaxOpenConns(1)
-// ensures it applies to every query on the returned DB.
+// use this variant.
 func newHandlerWithFK(t *testing.T) (AuthAdapterRPC, func()) {
 	t.Helper()
-	base := testutil.CreateBaseDB(context.Background(), t)
-	base.DB.SetMaxOpenConns(1)
-	_, err := base.DB.ExecContext(context.Background(), "PRAGMA foreign_keys = ON")
-	if err != nil {
-		t.Fatal(err)
-	}
+	base := testutil.CreateBaseDBWithFK(context.Background(), t)
 	adapter := authadapter.New(base.Queries, base.DB)
 	h := New(AuthAdapterRPCDeps{Adapter: adapter})
 	return h, base.Close

packages/server/pkg/testutil/testutil.go

@@ -48,6 +48,20 @@ func CreateBaseDB(ctx context.Context, t *testing.T) *BaseDBQueries {
 	return &BaseDBQueries{Queries: queries, t: t, ctx: ctx, DB: db}
 }
 
+// CreateBaseDBWithFK is like CreateBaseDB but enables SQLite foreign-key
+// enforcement (PRAGMA foreign_keys = ON) so that ON DELETE CASCADE constraints
+// fire. The connection pool is limited to one connection so the PRAGMA applies
+// to every query executed on the returned DB.
+func CreateBaseDBWithFK(ctx context.Context, t *testing.T) *BaseDBQueries {
+	t.Helper()
+	base := CreateBaseDB(ctx, t)
+	base.DB.SetMaxOpenConns(1)
+	if err := dbtest.EnableForeignKeys(ctx, base.DB); err != nil {
+		t.Fatal(err)
+	}
+	return base
+}
+
 func (c BaseDBQueries) GetBaseServices() BaseTestServices {
 	queries := c.Queries