-- Lets an admin/master admin temporarily suspend another account's 2FA
-- (e.g. they lost their phone) without wiping the enrolled method/secret,
-- so it can be switched back on later without the account re-enrolling.
ALTER TABLE admin_users ADD COLUMN two_factor_disabled_at DATETIME NULL AFTER two_factor_enabled_at;
