-- Ban-replay on reconnect. A ban is not a soft-delete (it sets `uploads_hidden`/`is_banned`,
-- never `upload.deleted_at`), and live eviction rode only on the ephemeral `user-hidden` SSE
-- broadcast — which has no reconnect-replay. So a client (especially the unattended diashow
-- projector) that missed that broadcast kept cycling the banned user's already-loaded slides.
--
-- `uploads_hidden_at` stamps WHEN a user's uploads became hidden, so the reconnect delta can
-- return the set of users hidden since the client's cursor and the client can evict them.
ALTER TABLE "user"
    ADD COLUMN uploads_hidden_at TIMESTAMPTZ;

-- Backfill already-hidden users so a reconnect right after this migration still evicts them.
UPDATE "user" SET uploads_hidden_at = NOW() WHERE uploads_hidden = TRUE;