-- v20 — Security first-run: deactivate seeded console accounts (replace via /api/setup/bootstrap)
IF OBJECT_ID('ctl.ConsoleUsers', 'U') IS NOT NULL
BEGIN
    UPDATE ctl.ConsoleUsers
    SET IsActive = 0
    WHERE Email IN (
        N'admin@sovereign.local',
        N'operator@sovereign.local',
        N'auditor@sovereign.local'
    )
    AND IsActive = 1;
END
GO

PRINT 'v20 — seed console users deactivated; complete first-run setup to create an administrator.';
GO
