-- External identity (Clerk / generic OIDC SSO): the issuer's stable
-- subject must map to exactly one user (JIT provisioning keys on it).

CREATE UNIQUE INDEX users_auth_subject_idx
    ON users (auth_subject)
    WHERE auth_subject IS NOT NULL;