OTP security hardened

backend/app/database.py

@@ -232,6 +232,18 @@ ALTER TABLE tokens ADD COLUMN device_id TEXT;
 ALTER TABLE tokens ADD COLUMN token_family_id TEXT;
 CREATE INDEX IF NOT EXISTS idx_tokens_device_id ON tokens(device_id);
 CREATE INDEX IF NOT EXISTS idx_tokens_family_id ON tokens(token_family_id);
+'''),
+    (16, '''
+CREATE TABLE IF NOT EXISTS otp_recovery_codes (
+    id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL,
+    code_hash TEXT NOT NULL UNIQUE,
+    used INTEGER NOT NULL DEFAULT 0,
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    used_at TEXT,
+    FOREIGN KEY(user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+CREATE INDEX IF NOT EXISTS idx_otp_recovery_codes_user_id ON otp_recovery_codes(user_id);
 ''')
 ]