修复认证挑战与可信代理安全边界（07-17-auth-challenge-trusted-proxy-hardening）

server/prisma/schema.prisma

@@ -605,6 +605,16 @@ model Employee {
   login_failed_count    Int       @default(0)
   login_failed_first_at DateTime?
   login_locked_until    DateTime?
+  email_login_code_failed_count    Int       @default(0)
+  email_login_code_failed_first_at DateTime?
+  email_login_code_locked_until    DateTime?
+  email_login_code_last_requested_at DateTime?
+  password_reset_failed_count       Int       @default(0)
+  password_reset_failed_first_at    DateTime?
+  password_reset_locked_until       DateTime?
+  password_reset_request_count      Int       @default(0)
+  password_reset_request_first_at   DateTime?
+  password_reset_last_requested_at  DateTime?
   archived_at           DateTime?
 
   created_at DateTime @default(now())
@@ -723,6 +733,8 @@ model PasswordResetCode {
   code_hash          String
   expires_at         DateTime
   used_at            DateTime?
+  invalidated_at     DateTime?
+  attempts_count     Int       @default(0)
   created_at         DateTime  @default(now())
   created_ip         String?
   created_user_agent String?
@@ -730,6 +742,7 @@ model PasswordResetCode {
   employee Employee @relation(fields: [employee_id], references: [id], onDelete: Restrict)
 
   @@index([employee_id, created_at])
+  @@index([employee_id, invalidated_at, created_at])
   @@index([expires_at])
   @@map("password_reset_codes")
 }