feat: add 2FA and change title

backend/gestion/db/db_telegram.go

@@ -15,6 +15,7 @@ func (d *Database) MigrateAddTelegramColumns() {
 	migrations := []string{
 		`ALTER TABLE clients ADD COLUMN IF NOT EXISTS telegram_chat_id BIGINT`,
 		`ALTER TABLE users   ADD COLUMN IF NOT EXISTS telegram_chat_id BIGINT`,
+		`ALTER TABLE clients ADD COLUMN IF NOT EXISTS two_fa_enabled BOOLEAN NOT NULL DEFAULT FALSE`,
 	}
 	for _, q := range migrations {
 		if err := d.GDB.Exec(q).Error; err != nil {
@@ -127,3 +128,36 @@ func (d *Database) GetUserByTelegramChatID(chatID int64) (username, role string,
 
 	return "", "", fmt.Errorf("aucun compte lié à ce chat_id")
 }
+
+// ── 2FA sessions ─────────────────────────────────────────────────────────────
+
+const twoFASessionTTL = 5 * time.Minute
+
+type twoFASessionData struct {
+	Username string `json:"username"`
+	Code     string `json:"code"`
+}
+
+func Store2FASession(sessionToken, username, code string) error {
+	data, err := json.Marshal(twoFASessionData{Username: username, Code: code})
+	if err != nil {
+		return err
+	}
+	return Redis.Set(RedisCtx, "2fa:session:"+sessionToken, data, twoFASessionTTL).Err()
+}
+
+// Verify2FASession valide le code et retourne le username. GETDEL = atomique (anti-replay).
+func Verify2FASession(sessionToken, code string) (string, error) {
+	val, err := Redis.GetDel(RedisCtx, "2fa:session:"+sessionToken).Bytes()
+	if err != nil {
+		return "", fmt.Errorf("session invalide ou expirée")
+	}
+	var d twoFASessionData
+	if err := json.Unmarshal(val, &d); err != nil {
+		return "", fmt.Errorf("données corrompues")
+	}
+	if d.Code != code {
+		return "", fmt.Errorf("code incorrect")
+	}
+	return d.Username, nil
+}