🚧 Move imei_mapping and app_tokens to database

init/01_schema.sql

@@ -1,6 +1,9 @@
 -- Schema for the nodeledge MQTT data pipeline.
 -- Executed automatically by the postgres image on the FIRST database start
 -- (files in /docker-entrypoint-initdb.d are only run against an empty data dir).
+-- For an ALREADY RUNNING database apply the changes manually, e.g.
+--   docker compose exec db psql -U nodeledge -d nodeledge -f - < init/01_schema.sql
+-- (CREATE TABLE IF NOT EXISTS makes the whole script idempotent).
 
 CREATE TABLE IF NOT EXISTS mqtt_messages (
     id          BIGSERIAL PRIMARY KEY,
@@ -32,4 +35,25 @@ COMMENT ON COLUMN mqtt_messages.payload_time IS
     'Device timestamp extracted from the JSON payload at ingest time; NULL when absent or unparseable. received_at is the server receipt time.';
 
 COMMENT ON TABLE mqtt_messages IS
-    'JSON payloads received over MQTT; payload contains the original JSON with imei and device injected by the listener.';
+    'JSON payloads received over MQTT; payload contains the original JSON with imei and device injected by the listener.';
+
+-- API authentication tokens, stored as hex SHA-256 digests (never plaintext).
+-- The api seeds one row from BOOTSTRAP_APP_TOKEN when the table is empty.
+CREATE TABLE IF NOT EXISTS app_tokens (
+    app_name   TEXT PRIMARY KEY,
+    token_hash TEXT NOT NULL CHECK (token_hash ~ '^[0-9a-f]{64}$'),
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- IMEI -> device name mapping used by the listener at ingest time.
+CREATE TABLE IF NOT EXISTS imei_map (
+    imei       TEXT PRIMARY KEY CHECK (imei ~ '^[0-9]{15}$'),
+    device     TEXT NOT NULL CHECK (device <> ''),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+COMMENT ON TABLE app_tokens IS
+    'API app tokens as SHA-256 hex digests; seeded from BOOTSTRAP_APP_TOKEN when empty.';
+COMMENT ON TABLE imei_map IS
+    'IMEI -> device name mapping, polled by the listener every 5 seconds.';