diff --git a/.sqlx/query-040b9e27fe399c9f581f93966d753eb03952985b7cc1b23e219c444eed0159fb.json b/.sqlx/query-040b9e27fe399c9f581f93966d753eb03952985b7cc1b23e219c444eed0159fb.json
new file mode 100644
index 000000000..be64b4d45
--- /dev/null
+++ b/.sqlx/query-040b9e27fe399c9f581f93966d753eb03952985b7cc1b23e219c444eed0159fb.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE mfa_backup_codes SET is_used = true WHERE user_id = $1 AND is_used = false",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "040b9e27fe399c9f581f93966d753eb03952985b7cc1b23e219c444eed0159fb"
+}
diff --git a/.sqlx/query-1368d36645c2548f0e4fb545b0cc2ce019140db89e57baddc1942b977ab3a431.json b/.sqlx/query-1368d36645c2548f0e4fb545b0cc2ce019140db89e57baddc1942b977ab3a431.json
new file mode 100644
index 000000000..3dc4533f3
--- /dev/null
+++ b/.sqlx/query-1368d36645c2548f0e4fb545b0cc2ce019140db89e57baddc1942b977ab3a431.json
@@ -0,0 +1,18 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                INSERT INTO mfa_backup_codes (\n                    id, user_id, code_hash, code_hint, expires_at\n                ) VALUES ($1, $2, $3, $4, $5)\n                ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Uuid",
+        "Varchar",
+        "Varchar",
+        "Timestamptz"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "1368d36645c2548f0e4fb545b0cc2ce019140db89e57baddc1942b977ab3a431"
+}
diff --git a/.sqlx/query-3f7b62f1896d9d19ba56adde7119638d68a9cf64a78160e9e1ea5c9b2a0bbbb0.json b/.sqlx/query-3f7b62f1896d9d19ba56adde7119638d68a9cf64a78160e9e1ea5c9b2a0bbbb0.json
new file mode 100644
index 000000000..22a2a6fca
--- /dev/null
+++ b/.sqlx/query-3f7b62f1896d9d19ba56adde7119638d68a9cf64a78160e9e1ea5c9b2a0bbbb0.json
@@ -0,0 +1,58 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            SELECT\n                id, code_hint as hint, is_used, used_at,\n                used_from_ip::text as \"used_from_ip_str\", expires_at, created_at\n            FROM mfa_backup_codes\n            WHERE user_id = $1\n            ORDER BY created_at DESC\n            ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 1,
+        "name": "hint",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "is_used",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 3,
+        "name": "used_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 4,
+        "name": "used_from_ip_str",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 5,
+        "name": "expires_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 6,
+        "name": "created_at",
+        "type_info": "Timestamptz"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      true,
+      null,
+      false,
+      false
+    ]
+  },
+  "hash": "3f7b62f1896d9d19ba56adde7119638d68a9cf64a78160e9e1ea5c9b2a0bbbb0"
+}
diff --git a/.sqlx/query-6b774bb2e56924adfbd961d335fbf319b34186b30f241359d00440d8816c8772.json b/.sqlx/query-6b774bb2e56924adfbd961d335fbf319b34186b30f241359d00440d8816c8772.json
new file mode 100644
index 000000000..656fc99e1
--- /dev/null
+++ b/.sqlx/query-6b774bb2e56924adfbd961d335fbf319b34186b30f241359d00440d8816c8772.json
@@ -0,0 +1,34 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            SELECT\n                COUNT(*) FILTER (WHERE is_used = false) as \"remaining!\",\n                COUNT(*) FILTER (WHERE is_used = true) as \"used!\",\n                MIN(expires_at) FILTER (WHERE is_used = false) as \"earliest_expiry: chrono::DateTime<chrono::Utc>\"\n            FROM mfa_backup_codes\n            WHERE user_id = $1\n            ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "remaining!",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "used!",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "earliest_expiry: chrono::DateTime<chrono::Utc>",
+        "type_info": "Timestamptz"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      null,
+      null,
+      null
+    ]
+  },
+  "hash": "6b774bb2e56924adfbd961d335fbf319b34186b30f241359d00440d8816c8772"
+}
diff --git a/.sqlx/query-aea06694ee3e20e90795f0b3a9c43bfd0a233ea5223af844e5b2c402938db416.json b/.sqlx/query-aea06694ee3e20e90795f0b3a9c43bfd0a233ea5223af844e5b2c402938db416.json
new file mode 100644
index 000000000..ef5f0b022
--- /dev/null
+++ b/.sqlx/query-aea06694ee3e20e90795f0b3a9c43bfd0a233ea5223af844e5b2c402938db416.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            INSERT INTO mfa_config (\n                id, user_id, totp_secret_encrypted, totp_algorithm, totp_digits, totp_period,\n                is_enabled, is_verified, enrolled_at, verified_at, backup_codes_remaining\n            ) VALUES ($1, $2, $3, 'SHA1', 6, 30, true, true, $4, $4, 10)\n            ON CONFLICT (user_id) DO UPDATE SET\n                totp_secret_encrypted = EXCLUDED.totp_secret_encrypted,\n                is_enabled = true,\n                is_verified = true,\n                verified_at = $4,\n                backup_codes_remaining = 10\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Uuid",
+        "Bytea",
+        "Timestamptz"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "aea06694ee3e20e90795f0b3a9c43bfd0a233ea5223af844e5b2c402938db416"
+}
diff --git a/.sqlx/query-c00246b33b871002aa0a1a1a098ced5b5057a1e7cc7a4bf8a4200d4b5777a73b.json b/.sqlx/query-c00246b33b871002aa0a1a1a098ced5b5057a1e7cc7a4bf8a4200d4b5777a73b.json
new file mode 100644
index 000000000..18639aa84
--- /dev/null
+++ b/.sqlx/query-c00246b33b871002aa0a1a1a098ced5b5057a1e7cc7a4bf8a4200d4b5777a73b.json
@@ -0,0 +1,82 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            SELECT\n                id, user_id, is_enabled, is_verified,\n                enrolled_at as \"enrolled_at: chrono::DateTime<chrono::Utc>\",\n                verified_at as \"verified_at: chrono::DateTime<chrono::Utc>\",\n                last_used_at as \"last_used_at: chrono::DateTime<chrono::Utc>\",\n                backup_codes_remaining, failed_verification_attempts,\n                last_failed_attempt_at as \"last_failed_attempt_at: chrono::DateTime<chrono::Utc>\",\n                locked_until as \"locked_until: chrono::DateTime<chrono::Utc>\"\n            FROM mfa_config\n            WHERE user_id = $1\n            ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 1,
+        "name": "user_id",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 2,
+        "name": "is_enabled",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 3,
+        "name": "is_verified",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 4,
+        "name": "enrolled_at: chrono::DateTime<chrono::Utc>",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 5,
+        "name": "verified_at: chrono::DateTime<chrono::Utc>",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 6,
+        "name": "last_used_at: chrono::DateTime<chrono::Utc>",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 7,
+        "name": "backup_codes_remaining",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 8,
+        "name": "failed_verification_attempts",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 9,
+        "name": "last_failed_attempt_at: chrono::DateTime<chrono::Utc>",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 10,
+        "name": "locked_until: chrono::DateTime<chrono::Utc>",
+        "type_info": "Timestamptz"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false,
+      true,
+      true,
+      true,
+      false,
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "c00246b33b871002aa0a1a1a098ced5b5057a1e7cc7a4bf8a4200d4b5777a73b"
+}
diff --git a/.sqlx/query-dc585d296075abbee6d32a08ca49bfe047c0151433c2359e51ad3e3c5e878f6a.json b/.sqlx/query-dc585d296075abbee6d32a08ca49bfe047c0151433c2359e51ad3e3c5e878f6a.json
new file mode 100644
index 000000000..b9dd1eb50
--- /dev/null
+++ b/.sqlx/query-dc585d296075abbee6d32a08ca49bfe047c0151433c2359e51ad3e3c5e878f6a.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE mfa_enrollment_sessions SET is_active = false, completed_at = NOW() WHERE id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "dc585d296075abbee6d32a08ca49bfe047c0151433c2359e51ad3e3c5e878f6a"
+}
diff --git a/.sqlx/query-e19dc7e9161ae2510850e709c7fda7c398662e8081e3a7929132a2031555dc5a.json b/.sqlx/query-e19dc7e9161ae2510850e709c7fda7c398662e8081e3a7929132a2031555dc5a.json
new file mode 100644
index 000000000..d19fdf0c8
--- /dev/null
+++ b/.sqlx/query-e19dc7e9161ae2510850e709c7fda7c398662e8081e3a7929132a2031555dc5a.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE mfa_enrollment_sessions SET verification_attempts = verification_attempts + 1 WHERE id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "e19dc7e9161ae2510850e709c7fda7c398662e8081e3a7929132a2031555dc5a"
+}
diff --git a/.sqlx/query-ea9264a98b2bf6034a0ecaf22903b4e2d2647303c3e7a480ccea2df6359dc943.json b/.sqlx/query-ea9264a98b2bf6034a0ecaf22903b4e2d2647303c3e7a480ccea2df6359dc943.json
new file mode 100644
index 000000000..b1d7b7b50
--- /dev/null
+++ b/.sqlx/query-ea9264a98b2bf6034a0ecaf22903b4e2d2647303c3e7a480ccea2df6359dc943.json
@@ -0,0 +1,18 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            INSERT INTO mfa_enrollment_sessions (\n                id, user_id, temp_totp_secret_encrypted, qr_code_data,\n                is_active, expires_at\n            ) VALUES ($1, $2, $3, $4, true, $5)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Uuid",
+        "Bytea",
+        "Text",
+        "Timestamptz"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "ea9264a98b2bf6034a0ecaf22903b4e2d2647303c3e7a480ccea2df6359dc943"
+}
diff --git a/.sqlx/query-ed947b6e0201c32cd49d191293906361647f52ab989fd8a7fedcbb2a66748355.json b/.sqlx/query-ed947b6e0201c32cd49d191293906361647f52ab989fd8a7fedcbb2a66748355.json
new file mode 100644
index 000000000..957a69a86
--- /dev/null
+++ b/.sqlx/query-ed947b6e0201c32cd49d191293906361647f52ab989fd8a7fedcbb2a66748355.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE mfa_config SET is_enabled = false, updated_at = NOW() WHERE user_id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "ed947b6e0201c32cd49d191293906361647f52ab989fd8a7fedcbb2a66748355"
+}
diff --git a/.sqlx/query-fa8446a8e2163a642e241866e04bd55d93c3ee12244ac0aaf9489f41c35c9189.json b/.sqlx/query-fa8446a8e2163a642e241866e04bd55d93c3ee12244ac0aaf9489f41c35c9189.json
new file mode 100644
index 000000000..b824db34f
--- /dev/null
+++ b/.sqlx/query-fa8446a8e2163a642e241866e04bd55d93c3ee12244ac0aaf9489f41c35c9189.json
@@ -0,0 +1,41 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            SELECT \n                temp_totp_secret_encrypted, \n                is_active, \n                expires_at as \"expires_at: chrono::DateTime<chrono::Utc>\", \n                verification_attempts\n            FROM mfa_enrollment_sessions\n            WHERE id = $1 AND user_id = $2\n            ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "temp_totp_secret_encrypted",
+        "type_info": "Bytea"
+      },
+      {
+        "ordinal": 1,
+        "name": "is_active",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 2,
+        "name": "expires_at: chrono::DateTime<chrono::Utc>",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 3,
+        "name": "verification_attempts",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false
+    ]
+  },
+  "hash": "fa8446a8e2163a642e241866e04bd55d93c3ee12244ac0aaf9489f41c35c9189"
+}
diff --git a/services/api_gateway/.sqlx/query-040b9e27fe399c9f581f93966d753eb03952985b7cc1b23e219c444eed0159fb.json b/services/api_gateway/.sqlx/query-040b9e27fe399c9f581f93966d753eb03952985b7cc1b23e219c444eed0159fb.json
new file mode 100644
index 000000000..be64b4d45
--- /dev/null
+++ b/services/api_gateway/.sqlx/query-040b9e27fe399c9f581f93966d753eb03952985b7cc1b23e219c444eed0159fb.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE mfa_backup_codes SET is_used = true WHERE user_id = $1 AND is_used = false",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "040b9e27fe399c9f581f93966d753eb03952985b7cc1b23e219c444eed0159fb"
+}
diff --git a/services/api_gateway/.sqlx/query-1368d36645c2548f0e4fb545b0cc2ce019140db89e57baddc1942b977ab3a431.json b/services/api_gateway/.sqlx/query-1368d36645c2548f0e4fb545b0cc2ce019140db89e57baddc1942b977ab3a431.json
new file mode 100644
index 000000000..3dc4533f3
--- /dev/null
+++ b/services/api_gateway/.sqlx/query-1368d36645c2548f0e4fb545b0cc2ce019140db89e57baddc1942b977ab3a431.json
@@ -0,0 +1,18 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                INSERT INTO mfa_backup_codes (\n                    id, user_id, code_hash, code_hint, expires_at\n                ) VALUES ($1, $2, $3, $4, $5)\n                ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Uuid",
+        "Varchar",
+        "Varchar",
+        "Timestamptz"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "1368d36645c2548f0e4fb545b0cc2ce019140db89e57baddc1942b977ab3a431"
+}
diff --git a/services/api_gateway/.sqlx/query-14d82db2797ef3fc954626da40c7879d7ad81a15e4f0e2e59aee1e076bf6e507.json b/services/api_gateway/.sqlx/query-14d82db2797ef3fc954626da40c7879d7ad81a15e4f0e2e59aee1e076bf6e507.json
new file mode 100644
index 000000000..ed6c9ab13
--- /dev/null
+++ b/services/api_gateway/.sqlx/query-14d82db2797ef3fc954626da40c7879d7ad81a15e4f0e2e59aee1e076bf6e507.json
@@ -0,0 +1,82 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            SELECT\n                id, user_id, is_enabled, is_verified,\n                enrolled_at, verified_at, last_used_at,\n                backup_codes_remaining, failed_verification_attempts,\n                last_failed_attempt_at, locked_until\n            FROM mfa_config\n            WHERE user_id = $1\n            ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 1,
+        "name": "user_id",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 2,
+        "name": "is_enabled",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 3,
+        "name": "is_verified",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 4,
+        "name": "enrolled_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 5,
+        "name": "verified_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 6,
+        "name": "last_used_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 7,
+        "name": "backup_codes_remaining",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 8,
+        "name": "failed_verification_attempts",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 9,
+        "name": "last_failed_attempt_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 10,
+        "name": "locked_until",
+        "type_info": "Timestamptz"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false,
+      true,
+      true,
+      true,
+      false,
+      false,
+      true,
+      true
+    ]
+  },
+  "hash": "14d82db2797ef3fc954626da40c7879d7ad81a15e4f0e2e59aee1e076bf6e507"
+}
diff --git a/services/api_gateway/.sqlx/query-3f7b62f1896d9d19ba56adde7119638d68a9cf64a78160e9e1ea5c9b2a0bbbb0.json b/services/api_gateway/.sqlx/query-3f7b62f1896d9d19ba56adde7119638d68a9cf64a78160e9e1ea5c9b2a0bbbb0.json
new file mode 100644
index 000000000..22a2a6fca
--- /dev/null
+++ b/services/api_gateway/.sqlx/query-3f7b62f1896d9d19ba56adde7119638d68a9cf64a78160e9e1ea5c9b2a0bbbb0.json
@@ -0,0 +1,58 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            SELECT\n                id, code_hint as hint, is_used, used_at,\n                used_from_ip::text as \"used_from_ip_str\", expires_at, created_at\n            FROM mfa_backup_codes\n            WHERE user_id = $1\n            ORDER BY created_at DESC\n            ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 1,
+        "name": "hint",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "is_used",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 3,
+        "name": "used_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 4,
+        "name": "used_from_ip_str",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 5,
+        "name": "expires_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 6,
+        "name": "created_at",
+        "type_info": "Timestamptz"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      true,
+      null,
+      false,
+      false
+    ]
+  },
+  "hash": "3f7b62f1896d9d19ba56adde7119638d68a9cf64a78160e9e1ea5c9b2a0bbbb0"
+}
diff --git a/services/api_gateway/.sqlx/query-75e0990b8dc10dedaae86b4b70f8c2d46db843dfb52caf74e399ee26e04458be.json b/services/api_gateway/.sqlx/query-75e0990b8dc10dedaae86b4b70f8c2d46db843dfb52caf74e399ee26e04458be.json
new file mode 100644
index 000000000..757394f1e
--- /dev/null
+++ b/services/api_gateway/.sqlx/query-75e0990b8dc10dedaae86b4b70f8c2d46db843dfb52caf74e399ee26e04458be.json
@@ -0,0 +1,41 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            SELECT temp_totp_secret_encrypted, is_active, expires_at, verification_attempts\n            FROM mfa_enrollment_sessions\n            WHERE id = $1 AND user_id = $2\n            ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "temp_totp_secret_encrypted",
+        "type_info": "Bytea"
+      },
+      {
+        "ordinal": 1,
+        "name": "is_active",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 2,
+        "name": "expires_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 3,
+        "name": "verification_attempts",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false
+    ]
+  },
+  "hash": "75e0990b8dc10dedaae86b4b70f8c2d46db843dfb52caf74e399ee26e04458be"
+}
diff --git a/services/api_gateway/.sqlx/query-8346fb50f9c988a8c03a3001587bb2125c75d0eabf0ce741eb89e5b21afd503e.json b/services/api_gateway/.sqlx/query-8346fb50f9c988a8c03a3001587bb2125c75d0eabf0ce741eb89e5b21afd503e.json
new file mode 100644
index 000000000..0a5e66b2e
--- /dev/null
+++ b/services/api_gateway/.sqlx/query-8346fb50f9c988a8c03a3001587bb2125c75d0eabf0ce741eb89e5b21afd503e.json
@@ -0,0 +1,34 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            SELECT\n                COUNT(*) FILTER (WHERE is_used = false) as \"remaining!\",\n                COUNT(*) FILTER (WHERE is_used = true) as \"used!\",\n                MIN(expires_at) FILTER (WHERE is_used = false) as earliest_expiry\n            FROM mfa_backup_codes\n            WHERE user_id = $1\n            ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "remaining!",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "used!",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "earliest_expiry",
+        "type_info": "Timestamptz"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      null,
+      null,
+      null
+    ]
+  },
+  "hash": "8346fb50f9c988a8c03a3001587bb2125c75d0eabf0ce741eb89e5b21afd503e"
+}
diff --git a/services/api_gateway/.sqlx/query-aea06694ee3e20e90795f0b3a9c43bfd0a233ea5223af844e5b2c402938db416.json b/services/api_gateway/.sqlx/query-aea06694ee3e20e90795f0b3a9c43bfd0a233ea5223af844e5b2c402938db416.json
new file mode 100644
index 000000000..ef5f0b022
--- /dev/null
+++ b/services/api_gateway/.sqlx/query-aea06694ee3e20e90795f0b3a9c43bfd0a233ea5223af844e5b2c402938db416.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            INSERT INTO mfa_config (\n                id, user_id, totp_secret_encrypted, totp_algorithm, totp_digits, totp_period,\n                is_enabled, is_verified, enrolled_at, verified_at, backup_codes_remaining\n            ) VALUES ($1, $2, $3, 'SHA1', 6, 30, true, true, $4, $4, 10)\n            ON CONFLICT (user_id) DO UPDATE SET\n                totp_secret_encrypted = EXCLUDED.totp_secret_encrypted,\n                is_enabled = true,\n                is_verified = true,\n                verified_at = $4,\n                backup_codes_remaining = 10\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Uuid",
+        "Bytea",
+        "Timestamptz"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "aea06694ee3e20e90795f0b3a9c43bfd0a233ea5223af844e5b2c402938db416"
+}
diff --git a/services/api_gateway/.sqlx/query-dc585d296075abbee6d32a08ca49bfe047c0151433c2359e51ad3e3c5e878f6a.json b/services/api_gateway/.sqlx/query-dc585d296075abbee6d32a08ca49bfe047c0151433c2359e51ad3e3c5e878f6a.json
new file mode 100644
index 000000000..b9dd1eb50
--- /dev/null
+++ b/services/api_gateway/.sqlx/query-dc585d296075abbee6d32a08ca49bfe047c0151433c2359e51ad3e3c5e878f6a.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE mfa_enrollment_sessions SET is_active = false, completed_at = NOW() WHERE id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "dc585d296075abbee6d32a08ca49bfe047c0151433c2359e51ad3e3c5e878f6a"
+}
diff --git a/services/api_gateway/.sqlx/query-e19dc7e9161ae2510850e709c7fda7c398662e8081e3a7929132a2031555dc5a.json b/services/api_gateway/.sqlx/query-e19dc7e9161ae2510850e709c7fda7c398662e8081e3a7929132a2031555dc5a.json
new file mode 100644
index 000000000..d19fdf0c8
--- /dev/null
+++ b/services/api_gateway/.sqlx/query-e19dc7e9161ae2510850e709c7fda7c398662e8081e3a7929132a2031555dc5a.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE mfa_enrollment_sessions SET verification_attempts = verification_attempts + 1 WHERE id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "e19dc7e9161ae2510850e709c7fda7c398662e8081e3a7929132a2031555dc5a"
+}
diff --git a/services/api_gateway/.sqlx/query-ea9264a98b2bf6034a0ecaf22903b4e2d2647303c3e7a480ccea2df6359dc943.json b/services/api_gateway/.sqlx/query-ea9264a98b2bf6034a0ecaf22903b4e2d2647303c3e7a480ccea2df6359dc943.json
new file mode 100644
index 000000000..b1d7b7b50
--- /dev/null
+++ b/services/api_gateway/.sqlx/query-ea9264a98b2bf6034a0ecaf22903b4e2d2647303c3e7a480ccea2df6359dc943.json
@@ -0,0 +1,18 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            INSERT INTO mfa_enrollment_sessions (\n                id, user_id, temp_totp_secret_encrypted, qr_code_data,\n                is_active, expires_at\n            ) VALUES ($1, $2, $3, $4, true, $5)\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Uuid",
+        "Bytea",
+        "Text",
+        "Timestamptz"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "ea9264a98b2bf6034a0ecaf22903b4e2d2647303c3e7a480ccea2df6359dc943"
+}
diff --git a/services/api_gateway/.sqlx/query-ed947b6e0201c32cd49d191293906361647f52ab989fd8a7fedcbb2a66748355.json b/services/api_gateway/.sqlx/query-ed947b6e0201c32cd49d191293906361647f52ab989fd8a7fedcbb2a66748355.json
new file mode 100644
index 000000000..957a69a86
--- /dev/null
+++ b/services/api_gateway/.sqlx/query-ed947b6e0201c32cd49d191293906361647f52ab989fd8a7fedcbb2a66748355.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE mfa_config SET is_enabled = false, updated_at = NOW() WHERE user_id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "ed947b6e0201c32cd49d191293906361647f52ab989fd8a7fedcbb2a66748355"
+}