Add password hashing, user settings with 2FA, and project image lightbox.

Hardens auth with PBKDF2, lockouts, local QR setup, and safer embeds while moving account security under the username menu.

database/harden-auth.sql

@@ -0,0 +1,24 @@
+IF COL_LENGTH('dbo.admins', 'two_factor_secret') IS NOT NULL
+BEGIN
+    ALTER TABLE dbo.admins ALTER COLUMN two_factor_secret NVARCHAR(512) NULL;
+END
+IF COL_LENGTH('dbo.admins', 'password') IS NOT NULL
+BEGIN
+    ALTER TABLE dbo.admins ALTER COLUMN password NVARCHAR(255) NOT NULL;
+END
+IF COL_LENGTH('dbo.admins', 'login_failed_count') IS NULL
+BEGIN
+    ALTER TABLE dbo.admins ADD login_failed_count INT NOT NULL CONSTRAINT DF_admins_login_failed_count DEFAULT(0);
+END
+IF COL_LENGTH('dbo.admins', 'login_lock_until') IS NULL
+BEGIN
+    ALTER TABLE dbo.admins ADD login_lock_until DATETIME2 NULL;
+END
+IF COL_LENGTH('dbo.admins', 'totp_failed_count') IS NULL
+BEGIN
+    ALTER TABLE dbo.admins ADD totp_failed_count INT NOT NULL CONSTRAINT DF_admins_totp_failed_count DEFAULT(0);
+END
+IF COL_LENGTH('dbo.admins', 'totp_lock_until') IS NULL
+BEGIN
+    ALTER TABLE dbo.admins ADD totp_lock_until DATETIME2 NULL;
+END