feat(access): add guarded local password lifecycle and recovery

src/govoplan_access/backend/db/models.py

@@ -51,6 +51,26 @@ class Account(AccessBase, TimestampMixin):
     )
 
 
+class PasswordRecovery(AccessBase, TimestampMixin):
+    """Bounded, administrator-issued authorization; never retain the code."""
+
+    __tablename__ = "access_password_recoveries"
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=new_uuid)
+    account_id: Mapped[str] = mapped_column(
+        ForeignKey("access_accounts.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    issuer_account_id: Mapped[str] = mapped_column(
+        ForeignKey("access_accounts.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    issuer_membership_id: Mapped[str] = mapped_column(
+        ForeignKey("access_users.id", ondelete="CASCADE"), nullable=False
+    )
+    code_hash: Mapped[str] = mapped_column(String(64), nullable=False, unique=True)
+    expires_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
+    consumed_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+
+
 class Identity(AccessBase, TimestampMixin):
     __tablename__ = "access_identities"