-- Deploy before the application. No automatic expiry or browser unlock.
CREATE TABLE IF NOT EXISTS admin_login_guard (
 account_type VARCHAR(16) NOT NULL,
 account_id BIGINT NOT NULL,
 failed_count INT NOT NULL DEFAULT 0,
 locked TINYINT(1) NOT NULL DEFAULT 0,
 last_failure_time DATETIME NULL,
 locked_time DATETIME NULL,
 PRIMARY KEY(account_type, account_id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

-- Developer-only manual recovery example. Verify identity and investigate first.
-- Replace 123 with the verified account ID; use admin instead of cms_user for legacy admins.
-- START TRANSACTION;
-- UPDATE admin_login_guard SET failed_count=0, locked=0, locked_time=NULL
-- WHERE account_type='cms_user' AND account_id=123;
-- UPDATE cms_user SET status=1 WHERE id=123;
-- COMMIT;
-- Resetting a password or toggling status in the UI DOES NOT clear the guard lock.