Add user authentication and role management

lib/mvp-db.ts

@@ -149,6 +149,22 @@ export async function ensureSchema(database?: D1Database) {
       completed_at TEXT,
       created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
     )`,
+    `CREATE TABLE IF NOT EXISTS users (
+      id TEXT PRIMARY KEY,
+      username TEXT NOT NULL,
+      password_hash TEXT NOT NULL,
+      password_salt TEXT NOT NULL,
+      password_iterations INTEGER NOT NULL,
+      role TEXT NOT NULL,
+      created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+    )`,
+    `CREATE TABLE IF NOT EXISTS auth_sessions (
+      token_hash TEXT PRIMARY KEY,
+      user_id TEXT NOT NULL,
+      expires_at TEXT NOT NULL,
+      created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+    )`,
   ];
 
   for (const statement of statements) {
@@ -305,6 +321,25 @@ export async function ensureSchema(database?: D1Database) {
        ON collection_runs(task_id, scheduled_date)`,
     )
     .run();
+  await db
+    .prepare("CREATE UNIQUE INDEX IF NOT EXISTS users_username_idx ON users(username)")
+    .run();
+  await db
+    .prepare(
+      `CREATE UNIQUE INDEX IF NOT EXISTS users_single_super_admin_idx
+       ON users(role) WHERE role = 'super_admin'`,
+    )
+    .run();
+  await db
+    .prepare(
+      "CREATE INDEX IF NOT EXISTS auth_sessions_user_id_idx ON auth_sessions(user_id)",
+    )
+    .run();
+  await db
+    .prepare(
+      "CREATE INDEX IF NOT EXISTS auth_sessions_expires_at_idx ON auth_sessions(expires_at)",
+    )
+    .run();
   await db
     .prepare(
       `UPDATE distributions