-- C0PY 002 — tenant binding (resourceowner id from Zitadel introspection;
-- resolved server-side, NEVER from client input).

ALTER TABLE registries ADD COLUMN IF NOT EXISTS tenant_id TEXT NOT NULL DEFAULT '';
ALTER TABLE scans ADD COLUMN IF NOT EXISTS tenant_id TEXT NOT NULL DEFAULT '';

CREATE INDEX IF NOT EXISTS registries_tenant_idx ON registries(tenant_id);
CREATE INDEX IF NOT EXISTS scans_tenant_idx ON scans(tenant_id);