-- auth-flow-auditor C1 (portal half): add a per-user
-- password-change watermark so JWT sessions issued before the watermark
-- can be rejected by `verifyPortalToken` without a global secret rotation.
--
-- Stamped to NOW() for existing rows so no current session is invalidated
-- on deploy; future password resets / activations update it.

ALTER TABLE portal_users
  ADD COLUMN IF NOT EXISTS password_changed_at timestamptz NOT NULL DEFAULT now();

-- No index needed: lookup is a single-row PK fetch keyed on portal_users.id.
