feat(auth): add email-based 2FA for unknown devices

shop/supabase/migrations/20260811000000_device_2fa.sql

@@ -0,0 +1,36 @@
+-- Tabelle für bekannte, verifizierte Geräte
+CREATE TABLE IF NOT EXISTS public.known_devices (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+    device_hash TEXT NOT NULL,
+    ip_address TEXT,
+    user_agent TEXT,
+    verified_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+    UNIQUE (user_id, device_hash)
+);
+
+ALTER TABLE public.known_devices ENABLE ROW LEVEL SECURITY;
+
+DO $$ 
+BEGIN
+    IF NOT EXISTS (
+        SELECT 1 FROM pg_policies WHERE tablename = 'known_devices' AND policyname = 'Users can manage own devices'
+    ) THEN
+        CREATE POLICY "Users can manage own devices" ON public.known_devices
+            FOR ALL USING (auth.uid() = user_id);
+    END IF;
+END $$;
+
+-- Tabelle für temporäre OTP-Verifizierungscodes (ohne RLS-Zutritt für Clients)
+CREATE TABLE IF NOT EXISTS public.device_verification_codes (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+    code TEXT NOT NULL,
+    device_hash TEXT NOT NULL,
+    expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+);
+
+ALTER TABLE public.device_verification_codes ENABLE ROW LEVEL SECURITY;
+-- Keine Policies -> Nur serverseitiger Zugriff über Admin-Client