修复认证挑战与可信代理安全边界（07-17-auth-challenge-trusted-proxy-hardening）

server/prisma/migrations/20260717120000_auth_challenge_trusted_proxy_hardening/migration.sql

@@ -0,0 +1,28 @@
+ALTER TABLE "employees"
+    ADD COLUMN "email_login_code_failed_count" INTEGER NOT NULL DEFAULT 0,
+    ADD COLUMN "email_login_code_failed_first_at" TIMESTAMP(3),
+    ADD COLUMN "email_login_code_locked_until" TIMESTAMP(3),
+    ADD COLUMN "email_login_code_last_requested_at" TIMESTAMP(3),
+    ADD COLUMN "password_reset_failed_count" INTEGER NOT NULL DEFAULT 0,
+    ADD COLUMN "password_reset_failed_first_at" TIMESTAMP(3),
+    ADD COLUMN "password_reset_locked_until" TIMESTAMP(3),
+    ADD COLUMN "password_reset_request_count" INTEGER NOT NULL DEFAULT 0,
+    ADD COLUMN "password_reset_request_first_at" TIMESTAMP(3),
+    ADD COLUMN "password_reset_last_requested_at" TIMESTAMP(3);
+
+ALTER TABLE "password_reset_codes"
+    ADD COLUMN "invalidated_at" TIMESTAMP(3),
+    ADD COLUMN "attempts_count" INTEGER NOT NULL DEFAULT 0;
+
+CREATE INDEX "password_reset_codes_employee_id_invalidated_at_created_at_idx"
+    ON "password_reset_codes"("employee_id", "invalidated_at", "created_at");
+
+-- Existing codes were generated and consumed under the weaker legacy contract.
+-- Invalidate them at rollout instead of carrying unsafe compatibility forward.
+UPDATE "password_reset_codes"
+SET "invalidated_at" = CURRENT_TIMESTAMP
+WHERE "used_at" IS NULL AND "invalidated_at" IS NULL;
+
+UPDATE "email_login_codes"
+SET "used_at" = CURRENT_TIMESTAMP
+WHERE "used_at" IS NULL;