ALTER TABLE users ADD COLUMN IF NOT EXISTS permissions JSONB;

COMMENT ON COLUMN users.permissions IS 'Feature flags for role=user; null = default bundle. Superadmin ignores.';
