-- R01-N23: tombstone column for users.
--
-- An admin marks a user as a "former user" when their name/email should no
-- longer be displayed in the live UI (privacy / GDPR-style erasure).
-- The audit log's `user_email` column still keeps the historical value
-- verbatim — erasure laws permit retention for legal / security purposes —
-- so the trail does not break.
--
-- Nullable; NULL ⇒ active user. Stamped with a UTC ISO-8601 string when
-- tombstoned. A subsequent successful OIDC sign-in or an admin "restore"
-- action clears the column back to NULL.

ALTER TABLE users ADD COLUMN tombstoned_at TEXT;