test(oauth): read stored revoked_at raw in OAUTHTOKREPO-003

The case checks the text format revokeAllForClient and revokeById write.
Reading it through the entity runs DbTimestampType, which turns an epoch
integer or a Date into formatted text, so an integer write would still
pass. The two reads go back to raw statements under an allow marker and
assert the stored value is a string before matching its format.

server/tests/unit/db/repositories/OauthTokens.repository.test.ts

@@ -132,8 +132,12 @@ describe('OauthTokensRepository', () => {
       await tokens.revokeAllForClient('proto-3'); // legacy: datetime('now')
       await tokens.revokeById(idB);               // legacy: CURRENT_TIMESTAMP
 
-      const rowA = await tokenRow(idA);
-      const rowB = await tokenRow(idB);
+      // test-sql-allow: the stored text of revoked_at is under test, which DbTimestampType would normalise on read.
+      const rowA = testDb.prepare('SELECT revoked_at FROM oauth_tokens WHERE id = ?').get(idA) as { revoked_at: unknown };
+      // test-sql-allow: the stored text of revoked_at is under test, which DbTimestampType would normalise on read.
+      const rowB = testDb.prepare('SELECT revoked_at FROM oauth_tokens WHERE id = ?').get(idB) as { revoked_at: unknown };
+      expect(typeof rowA.revoked_at).toBe('string');
+      expect(typeof rowB.revoked_at).toBe('string');
       expect(rowA.revoked_at).toMatch(/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/);
       expect(rowB.revoked_at).toMatch(/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/);
     });