ALTER TABLE employees
  ADD COLUMN IF NOT EXISTS portal_pin_hash VARCHAR(255) NULL AFTER portal_enabled,
  ADD COLUMN IF NOT EXISTS portal_pin_updated_at DATETIME NULL AFTER portal_pin_hash;

ALTER TABLE employees
  ADD KEY idx_employees_portal_login (tenant_id, employee_code, portal_enabled, is_active);