CREATE TABLE trainers (
id INTEGER PRIMARY KEY AUTOINCREMENT,
email TEXT NOT NULL UNIQUE,
name TEXT NOT NULL,
password_hash TEXT NOT NULL,
totp_secret TEXT,
-- Base32,
NULL = 2FA nicht eingerichtet
totp_enabled INTEGER NOT NULL DEFAULT 0,
-- 0/1; nur aktiv wenn erfolgreich verifiziert
backup_codes TEXT,
-- JSON-Array der gehashten Backup-Codes
created_at TEXT NOT NULL DEFAULT (datetime('now')),
last_login_at TEXT,
account_id INTEGER REFERENCES accounts(id) ON DELETE CASCADE,
role TEXT NOT NULL DEFAULT 'owner'
CHECK(role IN ('owner','member')),
email_verified_at TEXT,
verify_token TEXT,
verify_token_expires_at TEXT
)