Initial commit: CI Agent competitive-intelligence monitoring app

FastAPI + Celery + Next.js + Postgres/Redis app with company monitoring,
source collection, LLM-based change analysis, enrichment, and account
security (Turnstile, escalating lockout, email verification).

apps/api/app/models/user.py

@@ -0,0 +1,47 @@
+"""User account model.
+
+`password_hash` is nullable because `AUTH_MODE=local` provisions a single
+fixed user with no password at all - that mode never routes through
+password verification, so there's nothing to hash.
+"""
+
+from __future__ import annotations
+
+import uuid
+from datetime import datetime
+from typing import TYPE_CHECKING
+
+from sqlalchemy import Boolean, DateTime, Integer, String
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from app.db.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
+
+if TYPE_CHECKING:
+    from app.models.refresh_token import RefreshToken
+
+# Fixed, deterministic user id used for AUTH_MODE=local so the same row is
+# reused across restarts rather than multiplying "local dev user" rows.
+LOCAL_DEV_USER_ID = uuid.UUID("00000000-0000-0000-0000-000000000001")
+LOCAL_DEV_USER_EMAIL = "[email protected]"
+
+
+class User(Base, UUIDPrimaryKeyMixin, TimestampMixin):
+    __tablename__ = "users"
+
+    email: Mapped[str] = mapped_column(String(320), unique=True, index=True)
+    password_hash: Mapped[str | None] = mapped_column(String(255), nullable=True)
+    display_name: Mapped[str] = mapped_column(String(120))
+    timezone: Mapped[str] = mapped_column(String(64), default="America/New_York")
+    is_active: Mapped[bool] = mapped_column(Boolean, default=True)
+    is_admin: Mapped[bool] = mapped_column(Boolean, default=False)
+
+    # Phase 19: email verification + escalating failed-login lockout. The
+    # fixed AUTH_MODE=local user is seeded as already-verified (it never
+    # goes through this flow - see auth_service.get_or_create_local_user).
+    email_verified: Mapped[bool] = mapped_column(Boolean, default=False)
+    failed_login_count: Mapped[int] = mapped_column(Integer, default=0)
+    locked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+
+    refresh_tokens: Mapped[list[RefreshToken]] = relationship(
+        back_populates="user", cascade="all, delete-orphan"
+    )