-- T0 (v0.8 MVP) — flat account table (SQLite). Retired by CP1 Postgres registries (T2-T4).
-- Stores ONLY hashes of the agent/client tokens (INV5): raw tokens are returned once at mint
-- and never persisted. No immutable-record ceremony at this phase.
CREATE TABLE IF NOT EXISTS flat_accounts (
  account_id        TEXT PRIMARY KEY,   -- uuid, unguessable
  subdomain         TEXT NOT NULL UNIQUE,
  agent_token_hash  TEXT NOT NULL,      -- scrypt$salt$hash — never the raw token
  client_token_hash TEXT NOT NULL
);