Improve security

database/migrations/2026_06_10_000000_create_trusted_devices_table.php

@@ -10,9 +10,15 @@ return new class extends Migration
 {
     public function up(): void
     {
+        // Clean up any partially-created table from a previously failed run
+        // (the table can be created before the foreign-key ALTER statement runs).
+        Schema::dropIfExists('trusted_devices');
+
         Schema::create('trusted_devices', function (Blueprint $table): void {
             $table->id();
-            $table->foreignId('user_id')->constrained()->cascadeOnDelete();
+            // users.id is INT UNSIGNED in this schema, so the FK column must match
+            // its type or MariaDB raises errno 150 "incorrectly formed" constraint.
+            $table->unsignedInteger('user_id');
             $table->string('token_hash', 64)->unique();
             $table->timestamp('expires_at')->index();
             $table->timestamp('last_used_at')->nullable();
@@ -20,6 +26,8 @@ return new class extends Migration
             $table->string('user_agent', 500)->nullable();
             $table->timestamps();
 
+            $table->foreign('user_id')->references('id')->on('users')->cascadeOnDelete();
+
             $table->index(['user_id', 'expires_at']);
         });
     }

database/migrations/2026_06_11_000000_create_password_reset_tokens_table.php

@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        if (Schema::hasTable('password_reset_tokens')) {
+            return;
+        }
+
+        Schema::create('password_reset_tokens', function (Blueprint $table): void {
+            $table->string('email')->primary();
+            $table->string('token');
+            $table->timestamp('created_at')->nullable();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('password_reset_tokens');
+    }
+};

database/migrations/2026_06_11_000001_add_resetguid_to_users_table.php

@@ -0,0 +1,28 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            if (! Schema::hasColumn('users', 'resetguid')) {
+                $table->string('resetguid')->nullable()->after('password');
+            }
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            if (Schema::hasColumn('users', 'resetguid')) {
+                $table->dropColumn('resetguid');
+            }
+        });
+    }
+};