-- lab_hosts routing mode — Phase 4.1, docs/PHASE4_1_PREPRODUCTION_HARDENING.md §1.
--
-- Removes the Gateway's dependency on env.internal_ip being reachable directly, which only
-- holds when Gateway and the Lab container share a Docker daemon (true in dev, false once
-- Labs run on a genuinely separate rn-lab-host-01 VM). A lab_host is either:
--   'direct' — Gateway reaches env.internal_ip:internal_port itself. Correct when Gateway and
--              this lab_host's Docker daemon share a network namespace (dev, single-host).
--   'router' — Gateway reaches this lab_host's Lab Host Router (router_endpoint) over mTLS
--              instead, carrying the environment's routing_token in a header; the Router
--              resolves that token to a local container on ITS OWN host and reverse-proxies.
--              Correct once this lab_host is a genuinely separate VM.
--
-- Existing 'dev-local' row keeps routing_mode='direct' (the default) — no behavior change for
-- current dev/single-host setups. All existing lab_hosts rows and every environments row are
-- untouched; this only adds columns.

ALTER TABLE lab_hosts ADD COLUMN IF NOT EXISTS routing_mode TEXT NOT NULL DEFAULT 'direct';
ALTER TABLE lab_hosts ADD COLUMN IF NOT EXISTS router_endpoint TEXT;

DO $$ BEGIN
  ALTER TABLE lab_hosts ADD CONSTRAINT lab_hosts_routing_mode_check
    CHECK (routing_mode IN ('direct', 'router'));
EXCEPTION
  WHEN duplicate_object THEN NULL;
END $$;

DO $$ BEGIN
  ALTER TABLE lab_hosts ADD CONSTRAINT lab_hosts_router_endpoint_required_check
    CHECK (routing_mode = 'direct' OR router_endpoint IS NOT NULL);
EXCEPTION
  WHEN duplicate_object THEN NULL;
END $$;