cli: avoid data-dir initialization for version; create db parent dirs; redact generated passwords in CLI output

- Prevent 'nx9-wg version' from creating data directories by avoiding database initialization.
- Create parent directories when an explicit --database path is provided.
- Redact printed generated administrator passwords; announce file path or redact instead.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

crates/nx9-wg-db/tests/test_store_lifecycle.rs

@@ -0,0 +1,52 @@
+//! Tests for Store initialization, WAL configuration, migrations, and SQLite invariants.
+
+use nx9_wg_db::Store;
+use sqlx::Row;
+use tempfile::NamedTempFile;
+
+#[tokio::test]
+async fn test_in_memory_store_lifecycle() {
+    let store = Store::connect_in_memory().await.expect("connect in-memory");
+    store.migrate().await.expect("run migrations");
+
+    // Verify foreign keys are enabled
+    let row = sqlx::query("PRAGMA foreign_keys")
+        .fetch_one(store.pool())
+        .await
+        .expect("pragma foreign_keys");
+    let fk: i64 = row.get(0);
+    assert_eq!(fk, 1, "foreign keys must be enabled");
+}
+
+#[tokio::test]
+async fn test_temp_file_store_wal_mode() {
+    let tmp = NamedTempFile::new().expect("temp file");
+    let path = tmp.path();
+
+    let store = Store::connect_path(path).await.expect("connect path");
+    store.migrate().await.expect("run migrations");
+
+    // Verify WAL mode is configured
+    let row = sqlx::query("PRAGMA journal_mode")
+        .fetch_one(store.pool())
+        .await
+        .expect("pragma journal_mode");
+    let mode: String = row.get(0);
+    assert_eq!(mode.to_lowercase(), "wal", "WAL mode must be active");
+
+    // Verify migrations table exists and records the initial migration
+    let migration_count_row = sqlx::query("SELECT COUNT(*) FROM _sqlx_migrations")
+        .fetch_one(store.pool())
+        .await
+        .expect("query migrations");
+    let count: i64 = migration_count_row.get(0);
+    assert!(count >= 1, "at least one migration should be recorded");
+}
+
+#[tokio::test]
+async fn test_migration_idempotence() {
+    let store = Store::connect_in_memory().await.expect("connect in-memory");
+    store.migrate().await.expect("first migration run");
+    // Running migrate a second time must succeed idempotently
+    store.migrate().await.expect("second migration run");
+}