Merge branch 'totp'

Both branches added database migration 3: DNSSEC (merged first) keeps 3
and TOTP becomes migration 4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/store.go

@@ -242,6 +242,23 @@ ALTER TABLE tokens ADD COLUMN prev_expires_at TEXT;
 	// 3: DNSSEC signing (the zone's dnssec-policy).
 	`
 ALTER TABLE zones ADD COLUMN dnssec_policy TEXT NOT NULL DEFAULT '';
+`,
+	// 4: two-factor login with TOTP. totp_pending holds a secret being set
+	// up until a code confirms it; totp_last_step is the newest time step
+	// used, so a code works only once. sessions.totp_at is when the
+	// session last proved a code (for actions that ask for a recent one).
+	`
+ALTER TABLE users ADD COLUMN totp_secret TEXT NOT NULL DEFAULT '';
+ALTER TABLE users ADD COLUMN totp_pending TEXT NOT NULL DEFAULT '';
+ALTER TABLE users ADD COLUMN totp_enabled_at TEXT;
+ALTER TABLE users ADD COLUMN totp_last_step INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE sessions ADD COLUMN totp_at TEXT;
+CREATE TABLE recovery_codes (
+	user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+	code_hash TEXT NOT NULL,
+	used_at TEXT,
+	PRIMARY KEY (user_id, code_hash)
+);
 `,
 }