-- Migration auth mode: per-user OAuth vs Google domain-wide delegation
ALTER TABLE migration_projects
    ADD COLUMN auth_mode TEXT NOT NULL DEFAULT 'oauth';

ALTER TABLE migration_projects
    ADD CONSTRAINT migration_projects_auth_mode_check
    CHECK (auth_mode IN ('oauth', 'google_dwd'));