-- Login-required by default. Until now a structure was reachable by anyone
-- unless it was made members-only (`private = 1`). We flip that baseline: every
-- structure now requires a logged-in user to view, and `public = 1` is the
-- explicit opt-out that puts a structure back on the open web (no login).
--
-- The two flags are independent axes, resolved by canAccessStructure in db.js:
--   public = 1              -> anyone, no login          (opt-in, with a warning)
--   public = 0, private = 0 -> any logged-in user        (the new default)
--   public = 0, private = 1 -> invited members only      (unchanged)
ALTER TABLE structures ADD COLUMN public INTEGER NOT NULL DEFAULT 0;

-- squirtify (prod id 28) was live on the open web under the old public-by-default
-- world; keep it reachable without login so nothing breaks for its users.
UPDATE structures SET public = 1 WHERE id = 28;