feat(auth,privacy,web): step-by-step login, privacy settings persistence, TOTP QR, and API docs

app/users/schemas.py

@@ -1,6 +1,11 @@
 from datetime import datetime
 
 from pydantic import BaseModel, ConfigDict, EmailStr, Field
+from typing import Literal
+
+
+PrivacyLevel = Literal["everyone", "contacts", "nobody"]
+GroupInvitePrivacyLevel = Literal["everyone", "contacts"]
 
 
 class UserBase(BaseModel):
@@ -21,6 +26,9 @@ class UserRead(UserBase):
     bio: str | None = None
     email_verified: bool
     allow_private_messages: bool
+    privacy_last_seen: PrivacyLevel = "everyone"
+    privacy_avatar: PrivacyLevel = "everyone"
+    privacy_group_invites: GroupInvitePrivacyLevel = "everyone"
     twofa_enabled: bool = False
     created_at: datetime
     updated_at: datetime
@@ -32,6 +40,9 @@ class UserProfileUpdate(BaseModel):
     bio: str | None = Field(default=None, max_length=500)
     avatar_url: str | None = Field(default=None, max_length=512)
     allow_private_messages: bool | None = None
+    privacy_last_seen: PrivacyLevel | None = None
+    privacy_avatar: PrivacyLevel | None = None
+    privacy_group_invites: GroupInvitePrivacyLevel | None = None
 
 
 class UserSearchRead(BaseModel):