1-- Keypair-first identity. A user may hold several external identities2-- (device keypairs 'key:<pubkey>', shoo 'shoo pairwise_sub', dev3-- 'local:<name>'). users.external_id remains the FIRST identity for4-- back-compat; authentication resolves through this table.5CREATE TABLE user_identities (6 external_id TEXT PRIMARY KEY,7 user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,8 created_at INTEGER NOT NULL9);10CREATE INDEX idx_user_identities_user ON user_identities(user_id);1112-- Backfill existing single identities.13INSERT INTO user_identities (external_id, user_id, created_at)14 SELECT external_id, id, created_at FROM users;