ALTER TABLE AdminAuditLog ADD COLUMN riskLevel VARCHAR(16) NULL;
ALTER TABLE AdminAuditLog ADD COLUMN reason VARCHAR(500) NULL;
CREATE TABLE SecurityEvent (
    id VARCHAR(191) NOT NULL, userId VARCHAR(191), adminUserId VARCHAR(191),
    eventType VARCHAR(64) NOT NULL, severity VARCHAR(16) NOT NULL DEFAULT 'low',
    ip VARCHAR(45), userAgent VARCHAR(500), detail JSON,
    handled BOOLEAN NOT NULL DEFAULT false, handledBy VARCHAR(100),
    createdAt DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
    INDEX SecurityEvent_userId_idx(userId), INDEX SecurityEvent_eventType_idx(eventType),
    INDEX SecurityEvent_createdAt_idx(createdAt), PRIMARY KEY (id)
) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
