-- Add reality_prk to store the REALITY private key on the node row.
-- Previously reality_pbk was overloaded to hold the private key (which the
-- agent needs for its inbound); this migration separates concerns:
--   reality_pbk  = REALITY x25519 PUBLIC key  (used in client connect config)
--   reality_prk  = REALITY x25519 PRIVATE key (used by the agent for its inbound TLS)
-- Existing rows: reality_pbk continues to hold whatever was there until the
-- operator seeds / updates the node row via nodectl or direct SQL.
ALTER TABLE nodes
  ADD COLUMN reality_prk VARCHAR(64) NOT NULL DEFAULT '' AFTER reality_pbk,
  ADD COLUMN reality_short_id VARCHAR(16) NOT NULL DEFAULT '' AFTER reality_prk;