OTP security hardened

backend/app/api/admin.py

@@ -94,6 +94,21 @@ def list_users(_: dict = Depends(require_admin)):
     return [public_user(row) for row in rows]
 
 
+@router.post('/users/{user_id}/otp/reset')
+def reset_user_otp(user_id: str, _: dict = Depends(require_admin)):
+    with get_connection() as conn:
+        target = conn.execute('SELECT id FROM users WHERE id = ?', (user_id,)).fetchone()
+        if target is None:
+            raise HTTPException(status_code=404, detail='User not found')
+        conn.execute(
+            'UPDATE users SET otp_enabled = 0, otp_secret = NULL, updated_at = CURRENT_TIMESTAMP WHERE id = ?',
+            (user_id,),
+        )
+        conn.execute('DELETE FROM otp_recovery_codes WHERE user_id = ?', (user_id,))
+        conn.commit()
+    return {'status': 'otp_reset', 'enabled': False, 'user_id': user_id}
+
+
 @router.post('/users', status_code=201)
 def create_user(payload: AdminUserCreate, _: dict = Depends(require_admin)):
     username = payload.username.strip()