feat: complete Phase 0 Enterprise IAM

src/db/migrations/postgres/0015_create_refresh_tokens.sql

@@ -0,0 +1,12 @@
+-- Opaque refresh tokens issued at login (hashed at rest with BLAKE3).
+CREATE TABLE IF NOT EXISTS refresh_tokens (
+    id          TEXT    PRIMARY KEY NOT NULL,
+    user_id     TEXT    NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    token_hash  TEXT    NOT NULL UNIQUE,
+    expires_at  TEXT    NOT NULL,
+    revoked     INTEGER NOT NULL DEFAULT 0,
+    created_at  TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%SZ', 'now'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_refresh_tokens_user ON refresh_tokens(user_id);
+CREATE INDEX IF NOT EXISTS idx_refresh_tokens_hash ON refresh_tokens(token_hash);