chore: bump sea-ORM to v2

[lethib]

No description provided.

[claude]

Claude finished @lethib's task in 5m 31s —— View job

---

Review of PR #245: chore: bump sea-ORM to v2

• Gather context (PR diff, CI status, repo structure)
• Understand the request (code review)
• Review Code Quality
• Review Security
• Review Performance
• Review Testing
• Review Documentation
• Post inline comments for actionable findings
• Summarize findings

CI (cargo clippy --all-targets -- -D warnings, build, tests) is green on this PR, so compile/lint-level issues are already covered. My review focused on behavioral/maintainability risk from the SeaORM 1.1 → 2.0.0-rc.41 migration. Left 3 inline comments:

1. Cargo.toml — dependency is pinned to an exact release-candidate version (=2.0.0-rc.41), not a stable 2.0.0. Worth confirming this is intentional and tracked for a follow-up bump once stable ships.
2. src/services/practitioner_office.rs (create) — the new builder-based creation duplicates the address validation/trimming logic that still lives in practitioner_offices::ActiveModel::create and user_practitioner_offices::ActiveModel::create. Those model-level methods are no longer called from any production path (only from tests/factories), so the codebase now has two divergent implementations of the same validation logic.
3. src/controllers/patient.rs (and the same pattern in src/models/users.rs) — replacing find_also_related + explicit .ok_or(UnexpectedError::should_not_happen()) with find_both_related removes the loud failure path for an orphaned FK row. Given the FKs are NOT NULL with on_delete = Cascade this should be unreachable, but worth confirming find_both_related's join semantics so a data-integrity bug wouldn't silently drop rows instead of erroring.

No security vulnerabilities or performance regressions found. The raw-SQL migration changes (execute → execute_raw) all operate on static, non-user-controlled strings, so no new injection surface. The dense entity format, COLUMN accessors, and update_from_params renames look correctly and consistently applied across all call sites.