Merge branch 'feature/iam-04-zwei-faktor-authentifizierung-totp' into feature/qa-02-pruefgate-identitaet-mandanten

# Conflicts:
#	DEVLOG.md
#	scripts/reset-test-env.sh
#	scripts/run-checks.sh

migrations/tenant/0003_totp.down.sql

@@ -0,0 +1,3 @@
+DROP TABLE IF EXISTS totp_policy;
+DROP TABLE IF EXISTS totp_recovery_codes;
+DROP TABLE IF EXISTS totp_credentials;

migrations/tenant/0003_totp.up.sql

@@ -0,0 +1,23 @@
+-- Zwei-Faktor-Authentifizierung TOTP (IAM-04, siehe core-kanban/tickets/IAM-04.md).
+CREATE TABLE totp_credentials (
+    user_id    UUID PRIMARY KEY REFERENCES users(id),
+    secret     TEXT NOT NULL,
+    confirmed  BOOLEAN NOT NULL DEFAULT false,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- code_hash enthaelt NIEMALS den Klartext-Wiederherstellungscode, nur dessen
+-- SHA-256-Hash. used_at markiert einmalige Verwendbarkeit (Akzeptanzkriterium 3).
+CREATE TABLE totp_recovery_codes (
+    id         UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id    UUID NOT NULL REFERENCES users(id),
+    code_hash  BYTEA NOT NULL UNIQUE,
+    used_at    TIMESTAMPTZ,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Erzwingbare Aktivierungspflicht pro Tenant (Singleton-Zeile, Modell C).
+CREATE TABLE totp_policy (
+    id       BOOLEAN PRIMARY KEY DEFAULT true CHECK (id),
+    required BOOLEAN NOT NULL DEFAULT false
+);