-- Per-garden public share token. When set, anyone holding the token may read the
-- garden read-only via /api/v1/public/gardens/:token, with no login and no OIDC.
-- NULL disables the public link. Unique (over non-NULL values) so a token maps to
-- at most one garden; rotating the token invalidates the previous URL.
ALTER TABLE gardens ADD COLUMN public_token TEXT;

CREATE UNIQUE INDEX idx_gardens_public_token ON gardens (public_token) WHERE public_token IS NOT NULL;