-- One-shot: run in Supabase Dashboard → SQL Editor.
-- Single active session per user for concurrent-device login blocking.

alter table public.users
  add column if not exists session_id text null,
  add column if not exists last_keepalive_at timestamp with time zone null;

comment on column public.users.session_id is
  'Current login session UUID (jti in the auth token). Null when logged out.';
comment on column public.users.last_keepalive_at is
  'Last successful POST /auth/keepalive (also set at login/register). Session is active for 30s after this.';