-- Add MFA grace period + last-verified columns to support
-- enrollment grace window for MFA-required roles (currently ADMIN)
-- and re-auth checks for sensitive admin operations.

ALTER TABLE "User"
  ADD COLUMN "mfaGraceStartedAt" TIMESTAMP(3),
  ADD COLUMN "mfaLastVerifiedAt" TIMESTAMP(3);