July 4 - Implement TOTP 2FA

app/models/user.py

@@ -33,6 +33,15 @@ class User(UserMixin, db.Model):
     set_password_token          = db.Column(db.String(64), nullable=True, index=True)
     set_password_token_expires  = db.Column(db.DateTime, nullable=True)
 
+    # ── Two-factor auth (phase35) — opt-in TOTP ───────────────────────────
+    # mfa_enabled gates the second-factor step at login. mfa_secret is the
+    # base32 TOTP shared secret. mfa_recovery_codes is a JSON list of hashed
+    # one-time backup codes (never stored in plaintext). All default off so
+    # existing accounts are unaffected until a user enrolls.
+    mfa_enabled         = db.Column(db.Boolean, nullable=False, default=False)
+    mfa_secret          = db.Column(db.String(64), nullable=True)
+    mfa_recovery_codes  = db.Column(db.JSON, nullable=True)
+
     # Relationships
     inspections = db.relationship('Inspection', backref='inspector', lazy='dynamic')