-- 0004_interface_roles.sql
-- Explicit WireGuard Interface Role: Overlay (primary client network) or Upstream (third-party VPN tunnel)

ALTER TABLE interfaces ADD COLUMN role TEXT NOT NULL DEFAULT 'overlay' CHECK (role IN ('overlay', 'upstream'));

UPDATE interfaces SET role = 'overlay' WHERE role IS NULL OR role = '';