Security alerts phase-2: 3 detectors (businessHoursEdit via server-action wrapper checking Argentina wall clock; rateSpike via pg_cron 2min job querying archive tables; adminAccountEdit via AFTER UPDATE trigger on users checking actor != target + admin role). Designs in db-pluto-cc-25529. Phase-1 (bulkDelete) already live via WI#82.