Initial commit: CI Agent competitive-intelligence monitoring app

FastAPI + Celery + Next.js + Postgres/Redis app with company monitoring,
source collection, LLM-based change analysis, enrichment, and account
security (Turnstile, escalating lockout, email verification).

apps/api/app/models/password_history.py

@@ -0,0 +1,28 @@
+"""Every password hash a user has ever had active - checked on password
+reset so a user can't "reset" back to a password they (or an attacker who
+learned it) has used before. Never used for anything except that
+membership check; nothing reads these hashes back out for display."""
+
+from __future__ import annotations
+
+import uuid
+from typing import TYPE_CHECKING
+
+from sqlalchemy import ForeignKey, String
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from app.db.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
+
+if TYPE_CHECKING:
+    from app.models.user import User
+
+
+class PasswordHistoryEntry(Base, UUIDPrimaryKeyMixin, TimestampMixin):
+    __tablename__ = "password_history_entries"
+
+    user_id: Mapped[uuid.UUID] = mapped_column(
+        ForeignKey("users.id", ondelete="CASCADE"), index=True
+    )
+    password_hash: Mapped[str] = mapped_column(String(255))
+
+    user: Mapped[User] = relationship()