Database – Whats the best way to determine when it is appropriate to use a database

Off top of my head...

• access proprietary hardware that exports its I/O by other means than a file. Be that scientific equipment, industrial machinery, or plain CD recorder and a digitizer tablet with tilt support.
• only HTTP and a small family of other protocols. You can't create sockets as you wish, transferring whatever binary data you desire. That vastly limits connectivity with other systems and services.
• No sane developer will create graphics-intensive game in Javascript. Broadband is not nearly comparable to DVD/HDD throughputs often needed. Support for 3D in Canvas is vastly inferior to what you get with game engines. No way to support joystick, multiple simultaneous keypresses, the open nature makes cheating easy. But primarily, the performance drop is not acceptable.
• Heavy sandboxing. You won't get stuff that deeply integrates into the OS. Screenshots, antivirus, virtual drives, background tasks a'la system tray, administrative tasks etc.
• can't be mission-critical. Depending on broadband at all times to run their basic software is not the preferred way most companies like to run.

I'm afraid adding a Web Service layer is probably the correct solution to your problem.

Separating the client from the underlying database implementation will probably help you in the long run too.

Adding a web service layer doesn't necessarily have to hurt performance...

Indeed, with an appropriate API, a web service can actually improve performance, by batching together multiple database queries within the data center LAN, rather than requiring multiple round trips over the WAN.

And of course a web service layer can often be scaled horizontally, and add appropriate caching to your database queries, perhaps even a change notification mechanism.

A server layer adds security that you cannot possibly ensure with apps running on a remote client. Anything that runs on a client can be "hacked" and should not really be considered in any way trusted. You should only really put presentation logic in the client, and host anything important on hardware you have complete control of.

I don't know about your apps, but my web apps are naturally split into several layers, with the presentation code separated from the persistence layer by at least one level of business logic that keeps the two apart. I find this makes it much easier to reason about my app, and so much faster to add or modify functionality. If the layers are separated anyway, it is relatively easy to keep the presentation layer in the client, and the rest on a server under my control.

So while you can solve your problems without introducing a "web service" layer, by the time you have written all the stored procedures (or equivalent) necessary to fill in the holes in the standard database security implementation, you would probably be better off writing a server-side application that you can write proper unit tests for.