User model

Pre-save: Hashes password with bcrypt if modified.
Pre findOneAndUpdate: Hashes plain-text password in update payload.

Mongoose model: User
Source: src/models/user.model.ts
Interface: IUser

Fields

Field	Type	Required	Default	Description
`firstName`	string	Yes	`""`	Given name
`middleName`	string	No	—	Middle name
`lastName`	string	No	`""`	Family name
`email`	string	Yes	—	Unique, indexed login identifier
`password`	string	No	`null`	Bcrypt-hashed; auto-hashed on save
`mfaSecret`	string	No	`null`	TOTP base32 secret
`role`	string	Yes	—	`admin` or `user` (`UserRole` enum)
`pageAccess`	ObjectId[]	No	—	Refs to `AppSetting` documents
`activeTab`	string[]	No	`['nifty','banknifty']`	Dashboard tab state
`activeTickerSymbolTab`	string	No	`'nifty'`	Active ticker tab
`activeOrderTab`	string	No	`'live'`	Active order view tab
`isLoggedIn`	boolean	Yes	`false`	Single-session flag
`isActive`	boolean	Yes	`true`	Account enabled
`isMfaEnabled`	boolean	No	`false`	MFA configured
`isMfaVerified`	boolean	No	`false`	MFA OTP verified this session
`deleted`	boolean	Yes	`false`	Soft-delete flag
`loginToken`	string	No	`null`	Current JWT session token
`createdBy`	ObjectId	No	—	Ref to `User`
`updatedBy`	ObjectId[]	No	—	Refs to `User`
`created_at`	Date	Auto	—	Creation timestamp
`updated_at`	Date	Auto	—	Last update timestamp

Virtual	Returns
`id`	Stringified `_id`