2FA-Reife: Recovery-Codes, Enforce-Policy für Admins, Admin-Reset

- Recovery-/Backup-Codes (8x, einmalig nutzbar) bei Aktivierung + Regenerieren;
  Login akzeptiert TOTP ODER Recovery-Code
- Setting enforce_2fa_admins: Admins ohne 2FA werden zur Einrichtung geleitet
- Admin kann 2FA eines Nutzers zurücksetzen (admin/users.php)
- Schema 0003 (users.totp_backup_codes); security.php zeigt Codes & Restanzahl

database.sql

@@ -32,6 +32,7 @@ CREATE TABLE IF NOT EXISTS `users` (
   `microsoft_id` VARCHAR(255) UNIQUE,
   `totp_secret` VARCHAR(64) NULL,
   `totp_enabled` TINYINT(1) NOT NULL DEFAULT 0,
+  `totp_backup_codes` TEXT NULL,
   `last_login` TIMESTAMP NULL,
   `created_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
   `updated_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
@@ -70,6 +71,8 @@ CREATE TABLE IF NOT EXISTS `api_keys` (
   `name` VARCHAR(255) NOT NULL,
   `key_prefix` VARCHAR(16) NOT NULL,
   `key_hash` VARCHAR(255) NOT NULL,
+  `scope` VARCHAR(16) NOT NULL DEFAULT 'write',
+  `rate_limit` INT NOT NULL DEFAULT 0,
   `created_by` INT,
   `last_used_at` TIMESTAMP NULL,
   `is_active` TINYINT(1) NOT NULL DEFAULT 1,
@@ -79,6 +82,13 @@ CREATE TABLE IF NOT EXISTS `api_keys` (
   INDEX `idx_active` (`is_active`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
 
+CREATE TABLE IF NOT EXISTS `api_key_hits` (
+  `id` BIGINT PRIMARY KEY AUTO_INCREMENT,
+  `api_key_id` INT NOT NULL,
+  `hit_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+  INDEX `idx_key_time` (`api_key_id`, `hit_at`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
 CREATE TABLE IF NOT EXISTS `vouchers` (
   `id` INT PRIMARY KEY AUTO_INCREMENT,
   `site_id` INT NOT NULL,