-- Phase 7: TOTP two-factor authentication
ALTER TABLE users
  ADD COLUMN IF NOT EXISTS totp_secret  VARCHAR(64)  NULL    AFTER is_active,
  ADD COLUMN IF NOT EXISTS totp_enabled TINYINT(1)   DEFAULT 0 AFTER totp_secret;
