-- Add citadel_tenant_id to projects for log environment routing.
-- Each project gets its own Citadel environment, and the tenant_id
-- is used by the agent DaemonSet to route container logs correctly.

ALTER TABLE projects ADD COLUMN IF NOT EXISTS
    citadel_tenant_id VARCHAR(64);

COMMENT ON COLUMN projects.citadel_tenant_id IS 'Citadel environment tenant ID for log routing (auto-provisioned on project create)';