add auth

backend/app/models.py

@@ -173,6 +173,22 @@ class DailyReport(Base):
     score: Mapped[float] = mapped_column(Float, default=0.0)
 
 
+class AuthSession(Base):
+    """A browser login, created by a password or Telegram sign-in.
+
+    The token is the cookie value itself (a random opaque string) — no server
+    side id/secret split needed for a single-user app. Expired rows are pruned
+    lazily whenever a session is looked up.
+    """
+
+    __tablename__ = "auth_sessions"
+
+    token: Mapped[str] = mapped_column(String(64), primary_key=True)
+    method: Mapped[str] = mapped_column(String(16))  # password | telegram
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=utcnow)
+    expires_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), index=True)
+
+
 class EventLog(Base):
     """Small append-only log used for "did we already send this?" questions.