-- OAuth 2.0 token storage for integrations that need real user-consent auth
-- (starting with Google Tasks, whose API has no service-account-friendly
-- sharing model the way Calendar does). One row per source; access_token
-- and expiry get overwritten on every refresh, refresh_token persists.
CREATE TABLE IF NOT EXISTS oauth_tokens (
    source TEXT PRIMARY KEY,
    access_token TEXT NOT NULL,
    refresh_token TEXT NOT NULL,
    token_type TEXT NOT NULL DEFAULT 'Bearer',
    expiry DATETIME,
    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
);