-- 11. ops：运营后台账号（独立登录，架构 §3.11）
-- 来源：docs/architecture/schema-draft.sql（2026-11-03 验证过的草案）
CREATE TABLE ops_admin (
  id            uuid PRIMARY KEY,
  username      text NOT NULL UNIQUE,
  display_name  text NOT NULL,
  secret_hash   text NOT NULL,
  totp_cipher   bytea NOT NULL,                         -- 二次验证密钥（密文）
  status        text NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'disabled')),
  created_at    timestamptz NOT NULL DEFAULT now(),
  updated_at    timestamptz NOT NULL DEFAULT now()
);

CREATE TABLE ops_session (
  id            uuid PRIMARY KEY,
  admin_id      uuid NOT NULL REFERENCES ops_admin (id),
  token_hash    bytea NOT NULL UNIQUE,
  ip            inet NOT NULL,
  created_at    timestamptz NOT NULL DEFAULT now(),
  expires_at    timestamptz NOT NULL,
  revoked_at    timestamptz
);