1-- AlterTable: user's TOTP seed (AES-256-GCM envelope, see sso-secrets.ts pattern) 2ALTER TABLE "users" ADD COLUMN "twoFactorSecret" TEXT; 3 4-- CreateIndex: one retention policy per (org, scope) 5CREATE UNIQUE INDEX "retention_policies_organizationId_scope_key" ON "retention_policies"("organizationId", "scope"); 6