-- 管理端账户（密码 argon2id；TOTP 密钥 AES-GCM 后以 BLOB 存储）
CREATE TABLE admins (
  id            INTEGER PRIMARY KEY AUTOINCREMENT,
  username      TEXT NOT NULL UNIQUE,
  pw_hash       TEXT NOT NULL,
  totp_secret   BLOB NOT NULL,
  status        TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active','disabled')),
  created_at    DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
  last_login_at DATETIME NULL
);