-- clauth_config: key/value store for daemon configuration
-- Used to persist tunnel hostname and other daemon settings
CREATE TABLE IF NOT EXISTS clauth_config (
  key        text PRIMARY KEY,
  value      jsonb NOT NULL,
  updated_at timestamptz DEFAULT now()
);

-- RLS: only service role can access (same pattern as other clauth tables)
ALTER TABLE clauth_config ENABLE ROW LEVEL SECURITY;

-- Seed: no tunnel by default (user must run clauth tunnel setup)
-- INSERT INTO clauth_config (key, value) VALUES ('tunnel_hostname', 'null');
