feat: add 2FA and change title

backend/gestion/db/db_clients.go

@@ -374,10 +374,12 @@ func (d *Database) GetClientByUsername(username string) (*models.Client, error)
 		MustChangePassword bool      `gorm:"column:must_change_password"`
 		PointsExtraJSON    []byte    `gorm:"column:points_extra"`
 		CreatedAt          time.Time `gorm:"column:created_at"`
+		TwoFAEnabled       bool      `gorm:"column:two_fa_enabled"`
 	}
 	err := d.GDB.Raw(`
 		SELECT id, username, password, nom, prenom, telephone, command, amende,
-		       must_change_password, COALESCE(points_extra, '{}'::jsonb) as points_extra, created_at
+		       must_change_password, COALESCE(points_extra, '{}'::jsonb) as points_extra, created_at,
+		       two_fa_enabled
 		FROM clients WHERE username = ?`, username).Scan(&row).Error
 	if err != nil {
 		return nil, fmt.Errorf("erreur lors de la récupération du client: %w", err)
@@ -397,6 +399,7 @@ func (d *Database) GetClientByUsername(username string) (*models.Client, error)
 		Amende:             row.Amende,
 		MustChangePassword: row.MustChangePassword,
 		CreatedAt:          row.CreatedAt,
+		TwoFAEnabled:       row.TwoFAEnabled,
 	}
 	client.PointsExtra = map[string]int{}
 	if len(row.PointsExtraJSON) > 0 {
@@ -406,6 +409,10 @@ func (d *Database) GetClientByUsername(username string) (*models.Client, error)
 	return client, nil
 }
 
+func (d *Database) SetClientTwoFAEnabled(clientID int, enabled bool) error {
+	return d.GDB.Model(&models.Client{}).Where("id = ?", clientID).Update("two_fa_enabled", enabled).Error
+}
+
 func (d *Database) GetClientPenaltiesInfo(username string) (map[string]interface{}, error) {
 	amende, err := d.GetClientAmende(username)
 	if err != nil {

backend/gestion/db/db_settings.go

@@ -66,6 +66,7 @@ func DefaultSettings() models.AppSettings {
 				},
 			},
 		},
+		ShopName: "Milieu-Nantais",
 		DeliveryMode: models.DeliveryModeConfig{
 			Mode:           "single",
 			CategoryRoutes: []models.CategoryRoute{},
@@ -81,6 +82,7 @@ func DefaultSettings() models.AppSettings {
 				"44860", "44220", "44118", "44710", "44690", "44119",
 			}},
 		},
+		Telegram2FAEnabled: false,
 	}
 }
 
@@ -149,6 +151,10 @@ func (d *Database) GetSettings() (models.AppSettings, error) {
 			if err := json.Unmarshal([]byte(row.Value), &mode); err == nil {
 				settings.DeliveryMode = mode
 			}
+		case "telegram_2fa_enabled":
+			settings.Telegram2FAEnabled = row.Value == "true"
+		case "shop_name":
+			settings.ShopName = row.Value
 		}
 	}
 	return settings, nil
@@ -226,7 +232,9 @@ func (d *Database) UpdateSettings(s models.AppSettings) error {
 		{"telegram_bot_token", s.TelegramBotToken},
 		{"telegram_bot_username", s.TelegramBotUsername},
 		{"telegram_notifications_enabled", boolStr(s.TelegramNotificationsEnabled)},
+		{"telegram_2fa_enabled", boolStr(s.Telegram2FAEnabled)},
 		{"delivery_mode", string(deliveryModeJSON)},
+		{"shop_name", s.ShopName},
 	}
 
 	upsert := `INSERT INTO app_settings (key, value) VALUES (?, ?)

backend/gestion/db/db_telegram.go

@@ -15,6 +15,7 @@ func (d *Database) MigrateAddTelegramColumns() {
 	migrations := []string{
 		`ALTER TABLE clients ADD COLUMN IF NOT EXISTS telegram_chat_id BIGINT`,
 		`ALTER TABLE users   ADD COLUMN IF NOT EXISTS telegram_chat_id BIGINT`,
+		`ALTER TABLE clients ADD COLUMN IF NOT EXISTS two_fa_enabled BOOLEAN NOT NULL DEFAULT FALSE`,
 	}
 	for _, q := range migrations {
 		if err := d.GDB.Exec(q).Error; err != nil {
@@ -127,3 +128,36 @@ func (d *Database) GetUserByTelegramChatID(chatID int64) (username, role string,
 
 	return "", "", fmt.Errorf("aucun compte lié à ce chat_id")
 }
+
+// ── 2FA sessions ─────────────────────────────────────────────────────────────
+
+const twoFASessionTTL = 5 * time.Minute
+
+type twoFASessionData struct {
+	Username string `json:"username"`
+	Code     string `json:"code"`
+}
+
+func Store2FASession(sessionToken, username, code string) error {
+	data, err := json.Marshal(twoFASessionData{Username: username, Code: code})
+	if err != nil {
+		return err
+	}
+	return Redis.Set(RedisCtx, "2fa:session:"+sessionToken, data, twoFASessionTTL).Err()
+}
+
+// Verify2FASession valide le code et retourne le username. GETDEL = atomique (anti-replay).
+func Verify2FASession(sessionToken, code string) (string, error) {
+	val, err := Redis.GetDel(RedisCtx, "2fa:session:"+sessionToken).Bytes()
+	if err != nil {
+		return "", fmt.Errorf("session invalide ou expirée")
+	}
+	var d twoFASessionData
+	if err := json.Unmarshal(val, &d); err != nil {
+		return "", fmt.Errorf("données corrompues")
+	}
+	if d.Code != code {
+		return "", fmt.Errorf("code incorrect")
+	}
+	return d.Username, nil
+}