fix: harden stack label permissions (#1036)

* fix: harden stack label permissions

* fix: avoid test db init from debug logging

backend/src/utils/debug.ts

@@ -1,3 +1,5 @@
+import { DatabaseService } from '../services/DatabaseService';
+
 /**
  * Shared diagnostic logging gate. Reads `developer_mode` from
  * DatabaseService, which caches the global_settings snapshot internally
@@ -18,11 +20,7 @@
 
 export function isDebugEnabled(): boolean {
   try {
-    // Dynamic require avoids circular-dependency issues when this
-    // utility is imported from services that DatabaseService itself
-    // depends on, and prevents SQLite side effects during tests.
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const { DatabaseService } = require('../services/DatabaseService');
+    if (process.env.NODE_ENV === 'test' && !process.env.DATA_DIR) return false;
     return DatabaseService.getInstance().getGlobalSettings().developer_mode === '1';
   } catch {
     return false;