[
  {
    "type": "create_table",
    "description": "Create rateLimitAttempts table for DB-based rate limiting fallback",
    "database": "kiosk_users",
    "check_query": "SHOW TABLES LIKE 'rateLimitAttempts'",
    "sql": "CREATE TABLE `rateLimitAttempts` (\n  `id` bigint(20) unsigned NOT NULL AUTO_INCREMENT,\n  `identifier` varchar(255) NOT NULL COMMENT 'IP address, user ID, or email',\n  `action` varchar(50) NOT NULL COMMENT 'Action type (login, password_reset, mfa_verify)',\n  `attempts` int(10) NOT NULL DEFAULT 1,\n  `firstAttemptAt` timestamp NOT NULL DEFAULT current_timestamp(),\n  `lastAttemptAt` timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),\n  `blockedUntil` timestamp NULL DEFAULT NULL COMMENT 'Lockout expiration',\n  PRIMARY KEY (`id`),\n  UNIQUE KEY `uk_identifier_action` (`identifier`, `action`),\n  KEY `idx_blockedUntil` (`blockedUntil`),\n  KEY `idx_lastAttemptAt` (`lastAttemptAt`)\n) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='Rate limiting fallback when Redis unavailable'"
  }
]