-- Per-tenant ClickHouse credentials, generated by
-- enterprise/internal/tenantprovision and consumed by
-- enterprise/internal/chrunner's per-tenant connection registry at
-- enterprise-api startup. Stored in the same place every other
-- control-plane secret in this schema lives (audit_writer's password is
-- an env var, not a DB row, since it's one shared credential -- these
-- are per-tenant and need to be looked up by tenant, hence a table).
-- Same trust model as CLICKHOUSE_PASSWORD already being plaintext in
-- docker-compose.yml/the Helm chart's Secret -- Postgres itself is
-- already trusted infrastructure in this design, not a new exposure.
ALTER TABLE data_sources ADD COLUMN IF NOT EXISTS clickhouse_username TEXT;
ALTER TABLE data_sources ADD COLUMN IF NOT EXISTS clickhouse_password TEXT;