-- Password support for app_user. Format stored: pbkdf2:<iterations>:<salt_b64>:<hash_b64>
-- Existing rows have NULL password_hash and cannot log in until one is set.

ALTER TABLE app_user ADD COLUMN password_hash TEXT;