Reapply "feat(loyalty): EnakPoint & EnakCoin" (#32)

This reverts commit 4e24f9bbb0.

migrations/000093_add_customer_pin.up.sql

@@ -0,0 +1,32 @@
+-- Customer PIN (docs/prd-point-coin.md F11, K8). A 6-digit PIN, separate from the
+-- login password, approves everything that moves EnakPoint or EnakCoin on the
+-- customer's request. Only its bcrypt hash is stored.
+ALTER TABLE customers
+    ADD COLUMN pin_hash               VARCHAR(255),
+    ADD COLUMN pin_set_at             TIMESTAMP WITH TIME ZONE,
+    -- Kept in the database, not a cache, so it cannot be dodged by waiting for a cache
+    -- to expire or by hitting another server (Q17).
+    ADD COLUMN pin_failed_attempts    INT NOT NULL DEFAULT 0,
+    ADD COLUMN pin_locked_until       TIMESTAMP WITH TIME ZONE,
+    -- Outgoing transfers are held for 24 hours after a PIN reset (Q16).
+    ADD COLUMN transfer_blocked_until TIMESTAMP WITH TIME ZONE,
+    ADD CONSTRAINT chk_customers_pin_failed_attempts CHECK (pin_failed_attempts >= 0);
+
+-- Security log of PIN events. Not a balance movement, so not in wallet_transactions.
+CREATE TABLE customer_security_events (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    customer_id UUID NOT NULL REFERENCES customers(id) ON DELETE RESTRICT,
+    -- PIN_SET, PIN_CHANGED, PIN_RESET, PIN_FAILED, PIN_LOCKED, PIN_REMOVED_BY_ADMIN
+    event VARCHAR(30) NOT NULL,
+    -- The admin, for PIN_REMOVED_BY_ADMIN.
+    actor_user UUID,
+    reason VARCHAR(255),
+    ip_address VARCHAR(45),
+    user_agent VARCHAR(255),
+    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+
+    CONSTRAINT chk_customer_security_events_admin CHECK (
+        event <> 'PIN_REMOVED_BY_ADMIN' OR (actor_user IS NOT NULL AND reason IS NOT NULL))
+);
+
+CREATE INDEX idx_customer_security_events_customer_id_created_at ON customer_security_events(customer_id, created_at DESC);