## What and why

<!-- What changed, and what problem it solves. Link the issue if there is one. -->

## How this was verified

<!-- Be specific and honest. "Ran the tests" is not enough — say which, and what they proved.
     If something is untested, say so here rather than leaving the reviewer to find out. -->

- [ ] CI is green
- [ ] Tests added or updated for the behaviour that changed
- [ ] Verified manually (describe how):

## Invariants

<!-- Tick only what applies to this change. See CLAUDE.md. -->

- [ ] Raw ingested bytes remain immutable; derived tables stay rebuildable
- [ ] No stored odometer added; wear still derived from installs
- [ ] Physical quantities stored as SI integers
- [ ] New user-owned tables have `user_id` + RLS policy + repository scope
- [ ] No secret can reach a response model, log line, or error message
- [ ] Migration survives `upgrade -> downgrade -1 -> upgrade`

## Risks and follow-ups

<!-- What might this break? What did you deliberately leave out? -->