threesome fixed

schemas/alter_users_session.sql

@@ -0,0 +1,11 @@
+-- One-shot: run in Supabase Dashboard → SQL Editor.
+-- Single active session per user for concurrent-device login blocking.
+
+alter table public.users
+  add column if not exists session_id text null,
+  add column if not exists last_keepalive_at timestamp with time zone null;
+
+comment on column public.users.session_id is
+  'Current login session UUID (jti in the auth token). Null when logged out.';
+comment on column public.users.last_keepalive_at is
+  'Last successful POST /auth/keepalive (also set at login/register). Session is active for 30s after this.';