auth modal

db/database.js

@@ -79,6 +79,25 @@ db.exec(`CREATE TABLE IF NOT EXISTS violation_types (
     updated_at  DATETIME DEFAULT CURRENT_TIMESTAMP
 )`);
 
+// ── Feature: Authentication ──────────────────────────────────────────────────
+// User accounts and login sessions. Passwords are stored as scrypt hashes
+// (see auth.js). The bootstrap admin account is created/synced from the
+// ADMIN_USERNAME / ADMIN_PASSWORD environment variables on startup.
+db.exec(`CREATE TABLE IF NOT EXISTS users (
+    id            INTEGER PRIMARY KEY AUTOINCREMENT,
+    username      TEXT    NOT NULL UNIQUE COLLATE NOCASE,
+    password_hash TEXT    NOT NULL,
+    role          TEXT    NOT NULL DEFAULT 'user',
+    created_at    DATETIME DEFAULT CURRENT_TIMESTAMP
+)`);
+
+db.exec(`CREATE TABLE IF NOT EXISTS sessions (
+    token      TEXT    PRIMARY KEY,
+    user_id    INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    expires_at DATETIME NOT NULL
+)`);
+
 // Recreate view so it always filters negated rows
 db.exec(`DROP VIEW IF EXISTS active_cpas_scores;
 CREATE VIEW active_cpas_scores AS