-- Migration 004 — Phase 8. Overrides (AGENTS.md §7, §11 Phase 8).
--
-- The shared device keycode lives in `settings` as a bcrypt hash under the key
-- 'device_keycode_hash'. It is never stored or logged in plaintext. The
-- key/value table also gives later phases a place for small settings without a
-- new migration.
--
-- grant_until is a time-limited exemption: while it is in the future the device
-- is unlocked even when a weekly window would otherwise block it. It is a
-- separate column from the manual lock's `until` so "grant 30 minutes" and
-- "lock until I unlock" cannot fight over the same value. A manual lock clears
-- a grant; a grant clears a manual lock.

ALTER TABLE state ADD COLUMN grant_until TEXT;

CREATE TABLE IF NOT EXISTS settings (
    key        TEXT PRIMARY KEY,
    value      TEXT NOT NULL,
    updated_at TEXT NOT NULL DEFAULT (datetime('now'))
);