Deploy 2: 2FA (App + Email) + REST API + CSV import-export + auto backup

- Filament v5 multiFactorAuthentication enabled on both panels (App + Email)
- HasAppAuthentication + HasEmailAuthentication on User and SuperAdmin
- Migration: app_authentication_secret + recovery_codes + email_authentication_at
- Sanctum REST API: /api/v1/login, /me, clients, vehicles, work-orders
- EnsureTokenMatchesTenant middleware blocks cross-tenant token usage
- CsvImportExport service: clients + vehicles bulk via plain CSV
- Import/Export buttons on Client + Vehicle list pages
- ApiTokens page in tenant panel (generate/revoke + last-used)
- BackupAllTenantsCommand + scheduler (daily 03:00, retain 14 days)
- Background scheduler in entrypoint.sh

database/migrations/2026_05_08_000010_create_personal_access_tokens_table.php

@@ -0,0 +1,26 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration {
+    public function up(): void
+    {
+        Schema::create('personal_access_tokens', function (Blueprint $table) {
+            $table->id();
+            $table->morphs('tokenable');
+            $table->string('name');
+            $table->string('token', 64)->unique();
+            $table->text('abilities')->nullable();
+            $table->timestamp('last_used_at')->nullable();
+            $table->timestamp('expires_at')->nullable();
+            $table->timestamps();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('personal_access_tokens');
+    }
+};

database/migrations/2026_05_08_000020_add_mfa_columns_to_users.php

@@ -0,0 +1,32 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration {
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->timestamp('email_authentication_at')->nullable()->after('locale');
+            $table->text('app_authentication_secret')->nullable()->after('email_authentication_at');
+            $table->json('app_authentication_recovery_codes')->nullable()->after('app_authentication_secret');
+        });
+
+        Schema::table('super_admins', function (Blueprint $table) {
+            $table->timestamp('email_authentication_at')->nullable()->after('is_active');
+            $table->text('app_authentication_secret')->nullable()->after('email_authentication_at');
+            $table->json('app_authentication_recovery_codes')->nullable()->after('app_authentication_secret');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->dropColumn(['email_authentication_at', 'app_authentication_secret', 'app_authentication_recovery_codes']);
+        });
+        Schema::table('super_admins', function (Blueprint $table) {
+            $table->dropColumn(['email_authentication_at', 'app_authentication_secret', 'app_authentication_recovery_codes']);
+        });
+    }
+};