Merge branch 'totp'

Both branches added database migration 3: DNSSEC (merged first) keeps 3
and TOTP becomes migration 4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/model/changeset.go

@@ -70,8 +70,17 @@ type User struct {
 	CreatedAt    time.Time  `json:"created_at"`
 	UpdatedAt    time.Time  `json:"updated_at"`
 	LastLoginAt  *time.Time `json:"last_login_at,omitempty"`
+	// TOTPEnabledAt is when the user turned on two-factor login (nil:
+	// off). The secrets never leave the server.
+	TOTPEnabledAt *time.Time `json:"totp_enabled_at,omitempty"`
+	TOTPSecret    string     `json:"-"`
+	TOTPPending   string     `json:"-"`
+	TOTPLastStep  int64      `json:"-"`
 }
 
+// HasTOTP reports whether the user logs in with a TOTP code.
+func (u *User) HasTOTP() bool { return u.TOTPSecret != "" }
+
 // Token is an API key. The secret is shown once at creation and only its
 // hash is stored.
 type Token struct {
@@ -125,6 +134,9 @@ type Session struct {
 	LastSeenAt time.Time `json:"last_seen_at"`
 	IP         string    `json:"ip"`
 	UserAgent  string    `json:"user_agent"`
+	// TOTPAt is when the session last proved a TOTP code (at login or
+	// since); nil for a session without two-factor login.
+	TOTPAt *time.Time `json:"totp_at,omitempty"`
 }
 
 // AuditEvent records an action.