updates

Backend/src/models/payment.py

@@ -12,6 +12,7 @@ class PaymentMethod(str, enum.Enum):
     bank_transfer = "bank_transfer"
     e_wallet = "e_wallet"
     stripe = "stripe"
+    paypal = "paypal"
 
 
 class PaymentType(str, enum.Enum):

Backend/src/models/user.py

@@ -17,6 +17,9 @@ class User(Base):
     avatar = Column(String(255), nullable=True)
     currency = Column(String(3), nullable=False, default='VND')  # ISO 4217 currency code
     is_active = Column(Boolean, nullable=False, default=True)
+    mfa_enabled = Column(Boolean, nullable=False, default=False)
+    mfa_secret = Column(String(255), nullable=True)  # TOTP secret key (encrypted in production)
+    mfa_backup_codes = Column(Text, nullable=True)  # JSON array of backup codes (hashed)
     created_at = Column(DateTime, default=datetime.utcnow, nullable=False)
     updated_at = Column(DateTime, default=datetime.utcnow, onupdate=datetime.utcnow, nullable=False)