-- Go-live hardening: session versioning, two-factor authentication
SET NAMES utf8mb4;
ALTER TABLE users
  ADD COLUMN session_version INT NOT NULL DEFAULT 1,
  ADD COLUMN mfa_secret VARCHAR(255) NULL COMMENT 'AES-256-GCM encrypted TOTP secret',
  ADD COLUMN mfa_enabled_at DATETIME NULL,
  ADD COLUMN mfa_last_step BIGINT NOT NULL DEFAULT 0,
  ADD COLUMN mfa_recovery TEXT NULL COMMENT 'JSON array of SHA-256 hashes of unused recovery codes',
  ADD COLUMN password_changed_at DATETIME NULL;
INSERT INTO settings (k, v) VALUES ('require_admin_mfa', '1'), ('health_token', '');
INSERT INTO comm_templates (code, channel, lang, subject, body) VALUES
('account_exists','email','en','Someone tried to create an account with your email','Hello {{name}},\n\nSomeone (maybe you) tried to apply to {{site}} with this email address, which already has an account.\n\nIf it was you, sign in or reset your password here:\n{{link}}\n\nIf it was not you, you can ignore this email. Nothing has changed.\n\n{{site}}');