-- §M5.5 / audit 2026-06-11 H-D1: AAD-bind the email-trigger inbound secret.
--
-- `email_trigger_details.inbound_secret_encrypted` was sealed v0 (no AAD, bound
-- only to the master key) because this table had no version column — so a
-- ciphertext could in principle be relocated between rows. The per-app `secrets`
-- table gained AAD versioning in 0042; this brings the same to email secrets.
--
-- The AAD binds to the SEALING OWNER (the group for a template, the app for a
-- standalone trigger) — deliberately NOT the per-row trigger_id, so a group
-- template's sealed bytes stay valid when the materializer copies them verbatim
-- to each descendant app (all share the group AAD). At open time the sealing
-- owner is recovered from `materialized_from -> template.group_id` (else the
-- app). v0 rows keep their exact pre-audit no-AAD read path (default 0).

ALTER TABLE email_trigger_details
    ADD COLUMN inbound_secret_version SMALLINT NOT NULL DEFAULT 0;
