-- AlterTable: user's TOTP seed (AES-256-GCM envelope, see sso-secrets.ts pattern)
ALTER TABLE "users" ADD COLUMN "twoFactorSecret" TEXT;

-- CreateIndex: one retention policy per (org, scope)
CREATE UNIQUE INDEX "retention_policies_organizationId_scope_key" ON "retention_policies"("organizationId", "scope");