-- Bring-your-own Beszel hub: a workspace connects its Beszel monitoring hub so we
-- read rich per-node metrics (GPU / temps / disk-IO / network / per-container) via
-- its PocketBase API. Credentials are used server-side only (never returned to the
-- client). TODO: move credentials into the cm-secrets broker store (like Tailscale).
CREATE TABLE workspace_beszel (
    workspace_id UUID PRIMARY KEY REFERENCES workspaces (id) ON DELETE CASCADE,
    hub_url      TEXT NOT NULL,
    username     TEXT NOT NULL,
    password     TEXT NOT NULL,
    connected_at TIMESTAMPTZ NOT NULL DEFAULT now()
);