-- CSRF-/Replay-Schutz fuer OIDC-Login (IAM-06, siehe
-- core-kanban/tickets/IAM-06.md). Einmal-Verwendung erzwungen ueber
-- used_at IS NULL in der Consume-Abfrage, analog IAM-03/IAM-09.
CREATE TABLE oidc_states (
    state      TEXT PRIMARY KEY,
    nonce      TEXT NOT NULL,
    expires_at TIMESTAMPTZ NOT NULL,
    used_at    TIMESTAMPTZ,
    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
);