-- Additive only: existing users/sessions/roast_plans rows and columns are untouched.
CREATE TABLE password_reset_tokens (token_hash text PRIMARY KEY, user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE, expires_at timestamptz NOT NULL, created_at timestamptz NOT NULL DEFAULT now());
ALTER TABLE users ADD COLUMN disabled_at timestamptz;
ALTER TABLE sessions ADD COLUMN user_agent text, ADD COLUMN ip text, ADD COLUMN last_seen_at timestamptz;
CREATE TABLE audit_events (id uuid PRIMARY KEY DEFAULT gen_random_uuid(), actor_user_id uuid REFERENCES users(id) ON DELETE SET NULL, action text NOT NULL, target text, created_at timestamptz NOT NULL DEFAULT now());
CREATE INDEX audit_events_created ON audit_events(created_at DESC);
CREATE INDEX sessions_user_id ON sessions(user_id);
CREATE INDEX password_reset_tokens_user_id ON password_reset_tokens(user_id);