feat(07-02): add user session schema, throttle table, and jwt config

Co-authored-by: Cursor <cursoragent@cursor.com>

models/throttle.go

@@ -0,0 +1,22 @@
+package models
+
+import "time"
+
+// Throttle is one failed-login counter, keyed by user and optional IP.
+type Throttle struct {
+	ID          uint       `gorm:"column:id;primaryKey"`
+	UserID      uint       `gorm:"column:user_id"`
+	IPAddress   *string    `gorm:"column:ip_address"`
+	Attempts    int        `gorm:"column:attempts"`
+	IsSuspended bool       `gorm:"column:is_suspended"`
+	SuspendedAt *time.Time `gorm:"column:suspended_at"`
+	IsBanned    bool       `gorm:"column:is_banned"`
+	CreatedAt   time.Time  `gorm:"column:created_at"`
+	UpdatedAt   time.Time  `gorm:"column:updated_at"`
+}
+
+func (Throttle) TableName() string { return "user_throttle" }
+
+func init() {
+	Register(Throttle{})
+}

models/user.go

@@ -1,17 +1,56 @@
 package models
 
-// User is the minimal users row the JWT guard loads.
+import "time"
+
+// User is the persisted account the JWT guard and user API load.
 type User struct {
-	ID                 uint   `gorm:"column:id;primaryKey"`
-	Email              string `gorm:"column:email"`
-	Password           string `gorm:"column:password" json:"-"`
-	MustChangePassword bool   `gorm:"column:must_change_password"`
+	ID                        uint       `gorm:"column:id;primaryKey"`
+	Email                     string     `gorm:"column:email"`
+	Password                  string     `gorm:"column:password" json:"-"`
+	MustChangePassword        bool       `gorm:"column:must_change_password"`
+	Name                      *string    `gorm:"column:name"`
+	Surname                   *string    `gorm:"column:surname"`
+	IsActivated               bool       `gorm:"column:is_activated"`
+	ActivatedAt               *time.Time `gorm:"column:activated_at"`
+	ActivationCode            *string    `gorm:"column:activation_code" json:"-"`
+	ActivationCodeIssuedAt    *time.Time `gorm:"column:activation_code_issued_at"`
+	ResetPasswordCode         *string    `gorm:"column:reset_password_code" json:"-"`
+	ResetPasswordCodeIssuedAt *time.Time `gorm:"column:reset_password_code_issued_at"`
+	HasSelfSetPassword        bool       `gorm:"column:has_self_set_password"`
+	MarketingConsent          bool       `gorm:"column:marketing_consent"`
+	IsOnboarded               bool       `gorm:"column:is_onboarded"`
+	OrganisationID            *uint      `gorm:"column:organisation_id"`
+	OrganisationRole          *string    `gorm:"column:organisation_role"`
+	PreferredLocale           *string    `gorm:"column:preferred_locale"`
+	TokensValidAfter          *time.Time `gorm:"column:tokens_valid_after"`
+	CreatedIPAddress          *string    `gorm:"column:created_ip_address"`
+	LastIPAddress             *string    `gorm:"column:last_ip_address"`
 }
 
 func (User) TableName() string { return "users" }
 
-// Hidden mirrors PHP User::$hidden for the columns this stub carries (D-08).
-func (User) Hidden() []string { return []string{"password"} }
+// Fillable is the register/update field list. Username, PIN, and GDPR columns
+// stay out of Phase 7 because no ported handler reads them.
+func (User) Fillable() []string {
+	return []string{
+		"name", "surname", "email", "password", "created_ip_address", "last_ip_address",
+		"is_onboarded", "preferred_locale", "marketing_consent", "organisation_id",
+		"organisation_role", "must_change_password",
+	}
+}
+
+// Hidden mirrors PHP User::$hidden for the secrets this model stores.
+func (User) Hidden() []string {
+	return []string{"password", "reset_password_code", "activation_code"}
+}
+
+// Rules is the register-time rule set. confirmed covers password_confirmation.
+func (User) Rules() map[string]string {
+	return map[string]string{
+		"email":    "required|between:6,255|email|unique:users",
+		"password": "required|between:8,255|confirmed",
+	}
+}
 
 func init() {
 	Register(User{})