GRANT UPDATE (llm_driver, llm_config, updated_at) ON tenants TO diwall_core_app;
GRANT INSERT, UPDATE (email, password, role, is_active, updated_at) ON users TO diwall_core_app;

CREATE INDEX IF NOT EXISTS users_tenant_role_idx ON users (tenant_id, role);
CREATE INDEX IF NOT EXISTS users_tenant_active_idx ON users (tenant_id, is_active);
