-- Add password reset fields to user table
ALTER TABLE "user" ADD COLUMN IF NOT EXISTS must_change_password BOOLEAN DEFAULT FALSE;
ALTER TABLE "user" ADD COLUMN IF NOT EXISTS password_reset_pin VARCHAR(6);
ALTER TABLE "user" ADD COLUMN IF NOT EXISTS pin_expires_at TIMESTAMP;

-- Update existing admin users to require password change (if any exist)
-- This is safe to run multiple times
UPDATE "user" 
SET must_change_password = TRUE 
WHERE is_admin = TRUE 
AND must_change_password IS NULL;
