-- Per-user signing-identity override.
--
-- A nullable address used to represent the user in SIGNING contexts only:
-- the EOI developer/approver signer slot (resolveCrmUser), the in-CRM
-- "your turn to sign" notification, and the "awaiting my signature" hub tab.
-- NEVER a login credential — better-auth identity stays single-email via
-- user.email / account.account_id. NULL → user signs as their own login email.
--
-- Additive + backward-compatible: every existing row defaults to NULL and is
-- byte-for-byte unaffected. No uniqueness constraint — a shared role mailbox
-- (e.g. sales@) may legitimately be referenced by one CRM user.

ALTER TABLE user_profiles ADD COLUMN IF NOT EXISTS signing_email text;
