CREATE TABLE IF NOT EXISTS user_mfa (
  id INTEGER PRIMARY KEY AUTOINCREMENT,
  user_id INTEGER NOT NULL,
  secret_enc BLOB NOT NULL,
  secret_iv BLOB NOT NULL,
  secret_tag BLOB NOT NULL,
  kdf_salt BLOB NOT NULL,
  enabled INTEGER NOT NULL DEFAULT 0,
  last_verified_at DATETIME,
  created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
  updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
);

CREATE UNIQUE INDEX IF NOT EXISTS idx_user_mfa_user ON user_mfa(user_id);