create table if not exists app_settings (
  key        text primary key,
  value      text not null,
  updated_at timestamptz not null default now(),
  updated_by uuid references users(id)
);

-- Only admins can read or write settings
alter table app_settings enable row level security;

create policy "admin_select_settings" on app_settings
  for select using (
    exists (select 1 from users where id = auth.uid() and role = 'admin')
  );

create policy "admin_update_settings" on app_settings
  for all using (
    exists (select 1 from users where id = auth.uid() and role = 'admin')
  );

-- Placeholder rows (empty value means "use env var")
insert into app_settings (key, value) values
  ('ANTHROPIC_API_KEY', ''),
  ('VOYAGE_API_KEY', '')
on conflict (key) do nothing;