added multi user support, move api key to database

backend/app/schemas.py

@@ -9,6 +9,84 @@ class ORMModel(BaseModel):
     model_config = ConfigDict(from_attributes=True)
 
 
+# ---------- auth: login / session / current user ----------
+class LoginRequest(BaseModel):
+    username: str = Field(max_length=64)
+    password: str = Field(min_length=1, max_length=256)
+
+
+class LoginResponse(BaseModel):
+    token: str
+    username: str
+    is_admin: bool
+    must_change_password: bool
+
+
+class CurrentUser(BaseModel):
+    id: int
+    username: str
+    is_admin: bool
+    must_change_password: bool
+
+
+class ChangePasswordRequest(BaseModel):
+    # Optional: a forced first-login change skips it (the user just authenticated
+    # with their current password to reach that screen). A normal self-service
+    # change from the account page still requires it.
+    current_password: str | None = Field(default=None, max_length=256)
+    new_password: str = Field(min_length=6, max_length=256)
+
+
+# ---------- admin users (radadmin_admins) ----------
+class AdminOut(ORMModel):
+    id: int
+    username: str
+    is_admin: bool
+    must_change_password: bool
+    created_at: datetime | None = None
+
+
+class AdminCreate(BaseModel):
+    username: str = Field(min_length=1, max_length=64)
+    password: str = Field(min_length=6, max_length=256)
+    is_admin: bool = False
+    force_password_change: bool = True  # require a reset on first login
+
+
+class ResetPasswordRequest(BaseModel):
+    new_password: str = Field(min_length=6, max_length=256)
+    force_password_change: bool = True  # make the user reset again on next login
+
+
+# ---------- API keys (radadmin_api_keys) ----------
+class ApiKeyOut(ORMModel):
+    id: int
+    name: str
+    key_prefix: str
+    created_by: str | None = None
+    created_at: datetime | None = None
+    last_used_at: datetime | None = None
+    revoked: bool
+
+
+class ApiKeyCreate(BaseModel):
+    name: str = Field(min_length=1, max_length=64)
+
+
+class ApiKeyCreated(ApiKeyOut):
+    key: str  # the raw key, shown only once at creation
+
+
+# ---------- activity log (radadmin_logs) ----------
+class LogOut(ORMModel):
+    id: int
+    username: str | None = None
+    action: str
+    detail: str | None = None
+    ip_address: str | None = None
+    created_at: datetime | None = None
+
+
 # ---------- customers ----------
 # Human metadata (name/phone/alias) lives in radadmin_clients now — customers holds
 # only the RADIUS-adjacent identity + billing status.