p0: harden realtime reconciliation and revoke-all token invalidation

alembic/versions/0022_user_access_revoked_before.py

@@ -0,0 +1,26 @@
+"""add access token revoke marker for users
+
+Revision ID: 0022_user_access_revoked_before
+Revises: 0021_chat_avatar_url
+Create Date: 2026-03-08
+"""
+
+from collections.abc import Sequence
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = "0022_user_access_revoked_before"
+down_revision: str | None = "0021_chat_avatar_url"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    op.add_column("users", sa.Column("access_revoked_before", sa.DateTime(timezone=True), nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column("users", "access_revoked_before")