-- Session provenance for the active-sessions surface (#370).
--
-- TWO addresses, not one, and the pair is the point: a session created at
-- home and now being used from somewhere else is the shape of a stolen
-- token. A single "current IP" column can't express that, and a single
-- "origin IP" column goes stale the moment the token moves.
--
-- text rather than inet, matching user_agent directly above: these are
-- stored to be displayed, never queried by subnet, and inet round-trips
-- through pgx/sqlc as a netip.Prefix that renders as "1.2.3.4/32" and would
-- need unwrapping at every display site.
--
-- DEFAULT '' rather than NULL so existing rows — and any future insert that
-- genuinely can't determine an address — stay renderable without a null
-- check at every call site. The UI reads empty as "unknown" rather than
-- inventing a value.
ALTER TABLE sessions
    ADD COLUMN created_ip text NOT NULL DEFAULT '',
    ADD COLUMN last_ip    text NOT NULL DEFAULT '';