-- Migration 018: Enable pgcrypto extension
--
-- Enables the PostgreSQL pgcrypto extension which provides:
--   - gen_random_bytes()   — cryptographically strong random byte generation
--   - pgp_sym_encrypt/decrypt() — PGP symmetric encryption helpers
--   - digest()             — SHA-1 / SHA-256 / MD5 hashing functions
--   - crypt() / gen_salt() — password hashing (bcrypt / des / md5)
--
-- This extension is a prerequisite for any future migration that applies
-- server-side column-level encryption or generates random tokens in SQL.
-- Application-layer encryption (EncryptionService, AES-256-CBC via node-forge)
-- does NOT require pgcrypto but the extension is harmless to install and
-- provides a useful server-side fallback.
--
-- Safe to run multiple times — CREATE EXTENSION IF NOT EXISTS is idempotent.

CREATE EXTENSION IF NOT EXISTS pgcrypto;
