July 4 - Implement TOTP 2FA

control/models.py

@@ -9,7 +9,7 @@ data-plane house style (db.Enum('a','b',...)).
 from urllib.parse import quote_plus
 
 from sqlalchemy import (
-    Column, Integer, String, Boolean, DateTime, Text,
+    Column, Integer, String, Boolean, DateTime, Text, JSON,
     ForeignKey, Enum, UniqueConstraint,
 )
 from sqlalchemy.orm import relationship
@@ -179,6 +179,11 @@ class Superadmin(ControlBase):
     active        = Column(Boolean, nullable=False, default=True)
     created_at    = Column(DateTime, nullable=False, default=now_eastern)
 
+    # ── Two-factor (control0005) — opt-in TOTP, mirrors the data-plane User ──
+    mfa_enabled        = Column(Boolean, nullable=False, default=False)
+    mfa_secret         = Column(String(64), nullable=True)
+    mfa_recovery_codes = Column(JSON, nullable=True)
+
     def set_password(self, password):
         self.password_hash = generate_password_hash(password)