-- API keys carry a scope controlling what they may do: "read" (GET only) or
-- "readwrite" (full access). Existing keys default to readwrite to preserve
-- current behavior.
ALTER TABLE api_keys ADD COLUMN scope TEXT NOT NULL DEFAULT 'readwrite';