ALTER TABLE `users` MODIFY COLUMN `oidc_iss` varchar(512);--> statement-breakpoint
ALTER TABLE `users` MODIFY COLUMN `oidc_sub` varchar(256);--> statement-breakpoint
ALTER TABLE `users` ADD `claimed` boolean DEFAULT false NOT NULL;
--> statement-breakpoint
-- Phase 12 backfill (D-07): existing OIDC users are effectively claimed —
-- prevents first-login-claims (D-08) from matching rows that already have an identity bound.
UPDATE `users` SET `claimed` = true WHERE `oidc_iss` IS NOT NULL;