-- Phase 2 D-24: principal table for OIDC-resolved users.
-- Identity is the OIDC `sub` claim (UNIQUE); email/display_name are mutable claims
-- refreshed by the JIT upsert in PrincipalResolver. Phase 3 layers
-- households/memberships/invites on top of this; do NOT add household_id here.
CREATE TABLE users (
    id           UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    sub          TEXT NOT NULL UNIQUE,
    email        TEXT NOT NULL,
    display_name TEXT NOT NULL,
    created_at   TIMESTAMPTZ NOT NULL DEFAULT now(),
    updated_at   TIMESTAMPTZ NOT NULL DEFAULT now()
);

CREATE INDEX users_sub_idx ON users(sub);
