release(secrets-mcp): 0.6.0 - local gateway onboarding and target_exec

crates/secrets-core/src/db.rs

@@ -220,6 +220,20 @@ pub async fn migrate(pool: &PgPool) -> Result<()> {
         CREATE UNIQUE INDEX IF NOT EXISTS idx_oauth_accounts_user_provider
             ON oauth_accounts(user_id, provider);
 
+        -- ── local_mcp_bind_sessions: short-lived browser approval state ──────────
+        CREATE TABLE IF NOT EXISTS local_mcp_bind_sessions (
+            bind_id      TEXT PRIMARY KEY,
+            device_code  TEXT NOT NULL,
+            user_id      UUID,
+            approved     BOOLEAN NOT NULL DEFAULT FALSE,
+            expires_at   TIMESTAMPTZ NOT NULL,
+            created_at   TIMESTAMPTZ NOT NULL DEFAULT NOW()
+        );
+        CREATE INDEX IF NOT EXISTS idx_local_mcp_bind_sessions_expires_at
+            ON local_mcp_bind_sessions(expires_at);
+        CREATE INDEX IF NOT EXISTS idx_local_mcp_bind_sessions_user_id
+            ON local_mcp_bind_sessions(user_id) WHERE user_id IS NOT NULL;
+
         -- FK: user_id columns -> users(id) (nullable = legacy rows; ON DELETE SET NULL)
         DO $$ BEGIN
             IF NOT EXISTS (