feat: implement metadata catalog database management

frontend/src/shell/AppShell.database-management.test.tsx

@@ -23,7 +23,7 @@ beforeEach(() => {
     issuer: "test",
     subject: "test",
     roles: ["admin"],
-    permissions: ["session.use", "workspace.manage", "workspace.secrets.manage", "pi.manage"],
+    permissions: ["session.use", "workspace.manage", "workspace.secrets.manage", "database.manage", "pi.manage"],
     isAdmin: true,
     csrfToken: null,
     session: null,
@@ -52,7 +52,7 @@ beforeEach(() => {
   );
 });
 
-test("opens the blank database management surface and returns to the core", async () => {
+test("opens the database management surface and returns to the core", async () => {
   renderShell();
 
   const composer = screen.getByRole("textbox", { name: /new question/i });
@@ -122,7 +122,7 @@ test("keeps a live core session connected and returns when that session is opene
   expect(FakeEventSource.instances).toHaveLength(1);
 });
 
-test("hides all management entries from non-admin users", () => {
+test("keeps read-safe workspace access but hides privileged management entries", () => {
   clearAuthState();
   setAuthState({
     issuer: "test",
@@ -136,7 +136,52 @@ test("hides all management entries from non-admin users", () => {
 
   renderShell();
 
-  expect(screen.queryByRole("button", { name: "Workspace management" })).not.toBeInTheDocument();
+  expect(screen.getByRole("button", { name: "Workspace management" })).toBeInTheDocument();
   expect(screen.queryByRole("button", { name: "Database management" })).not.toBeInTheDocument();
   expect(screen.queryByRole("button", { name: "Pi management" })).not.toBeInTheDocument();
 });
+
+test("does not leave database management without confirming a dirty form", async () => {
+  server.use(http.get("/api/catalog/databases", () => HttpResponse.json([{
+    id: "11111111-1111-4111-8111-111111111111",
+    workspaceId: "psd-clinical",
+    workspaceName: "Policlinico San Donato",
+    workspaceAvailable: true,
+    configured: true,
+    engine: "postgres",
+    databaseName: "warehouse",
+    schema: "datawarehouse",
+    version: 3,
+    createdAt: "2026-08-27T08:00:00Z",
+    updatedAt: "2026-08-27T09:00:00Z",
+    binding: { transport: "postgres_direct", host: "db.internal", port: 5432, username: "reader" },
+    connectionStatus: "untested",
+    secrets: {
+      password: false,
+      apiKey: false,
+      sshPrivateKey: false,
+      sshPrivateKeyPassphrase: false,
+      sshKnownHosts: false,
+      tlsCa: false,
+    },
+  }])));
+  const confirm = vi.spyOn(window, "confirm").mockReturnValue(false);
+  renderShell();
+
+  await userEvent.click(screen.getByRole("button", { name: "Database management" }));
+  await userEvent.click(await screen.findByRole("button", { name: "Edit Policlinico San Donato" }));
+  const schema = screen.getByLabelText("Schema");
+  await userEvent.clear(schema);
+  await userEvent.type(schema, "reporting");
+
+  await userEvent.click(screen.getByRole("button", { name: "New session" }));
+
+  expect(confirm).toHaveBeenCalledWith("Discard unsaved database changes and leave database management?");
+  expect(screen.getByRole("main", { name: "Database management" })).toBeVisible();
+  expect(schema).toHaveValue("reporting");
+
+  confirm.mockReturnValue(true);
+  await userEvent.click(screen.getByRole("button", { name: "New session" }));
+  await waitFor(() => expect(screen.queryByRole("main", { name: "Database management" })).not.toBeInTheDocument());
+  confirm.mockRestore();
+});