M4-T04: add AuthUser TOTP columns and auth_recovery_code table

tests/test_auth_throttle_model.py

@@ -171,12 +171,17 @@ def test_next_allowed_at_persists_when_set(throttle_db):
 
 
 def test_downgrade_removes_table(tmp_path: Path):
-    """downgrade -1 from head must cleanly drop auth_login_throttle."""
+    """Downgrading the auth_login_throttle revision must cleanly drop the table.
+
+    We upgrade to the specific throttle revision (not necessarily head, since later
+    revisions may have been added), then downgrade one step to verify the table is gone.
+    """
     db_path = tmp_path / "down_test.db"
     db_url = f"sqlite:///{db_path}"
     alembic_cfg = _make_app_alembic_config(db_url)
+    throttle_revision = "20260621_07_auth_login_throttle"
 
-    command.upgrade(alembic_cfg, "head")
+    command.upgrade(alembic_cfg, throttle_revision)
     engine = create_engine(db_url, connect_args={"check_same_thread": False})
     assert "auth_login_throttle" in inspect(engine).get_table_names()
     engine.dispose()