data holders: private tracker of every organisation holding my address, email, phone or IBAN

dataholders schema (orgs + identity) with migration and personal_app grants,
idempotent CSV import (upsert on name+login, never wipes, keeps site edits and
ticks), owner-only /trackers/data-holders with search, filters, pagination,
inline edit/add and a moving checklist per identifier

drizzle/20261025160958_dataholders/migration.sql

@@ -0,0 +1,83 @@
+CREATE SCHEMA "dataholders";
+--> statement-breakpoint
+CREATE TABLE "dataholders"."identity" (
+	"kind" text PRIMARY KEY,
+	"value" text NOT NULL,
+	"since" date NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "identity_kind_check" CHECK ("kind" IN ('address','email','phone','iban'))
+);
+--> statement-breakpoint
+CREATE TABLE "dataholders"."orgs" (
+	"id" integer PRIMARY KEY GENERATED ALWAYS AS IDENTITY (sequence name "dataholders"."orgs_id_seq" INCREMENT BY 1 MINVALUE 1 MAXVALUE 2147483647 START WITH 1 CACHE 1),
+	"name" text NOT NULL,
+	"category" text DEFAULT 'Other' NOT NULL,
+	"login" text,
+	"source" text,
+	"domains" text,
+	"import_key" text,
+	"holds_address" boolean DEFAULT false NOT NULL,
+	"holds_email" boolean DEFAULT false NOT NULL,
+	"holds_phone" boolean DEFAULT false NOT NULL,
+	"holds_iban" boolean DEFAULT false NOT NULL,
+	"holds_bsn" boolean DEFAULT false NOT NULL,
+	"holds_card" boolean DEFAULT false NOT NULL,
+	"holds_dob" boolean DEFAULT false NOT NULL,
+	"holds_id_doc" boolean DEFAULT false NOT NULL,
+	"data_held" text,
+	"address_on_file" text,
+	"address_status" text DEFAULT 'unknown' NOT NULL,
+	"follows_brp" boolean DEFAULT false NOT NULL,
+	"email_on_file" text,
+	"phone_on_file" text,
+	"action" text DEFAULT 'update' NOT NULL,
+	"priority" text DEFAULT 'should' NOT NULL,
+	"how_to_change" text,
+	"link" text,
+	"evidence" text,
+	"notes" text,
+	"address_updated_on" date,
+	"email_updated_on" date,
+	"phone_updated_on" date,
+	"iban_updated_on" date,
+	"last_checked" date,
+	"archived" boolean DEFAULT false NOT NULL,
+	"edited_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "orgs_name_check" CHECK (length(btrim("name")) > 0),
+	CONSTRAINT "orgs_address_status_check" CHECK ("address_status" IN ('confirmed','likely','unknown')),
+	CONSTRAINT "orgs_action_check" CHECK ("action" IN ('update','close','check','none')),
+	CONSTRAINT "orgs_priority_check" CHECK ("priority" IN ('must','should','nice'))
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX "orgs_import_key_key" ON "dataholders"."orgs" ("import_key");--> statement-breakpoint
+CREATE INDEX "orgs_category_idx" ON "dataholders"."orgs" ("category");--> statement-breakpoint
+-- Hand-written below this line (not generated by drizzle-kit).
+DO $$
+DECLARE t text;
+BEGIN
+  IF to_regprocedure('meta.touch_updated_at()') IS NOT NULL THEN
+    FOREACH t IN ARRAY ARRAY['orgs','identity'] LOOP
+      EXECUTE format('CREATE TRIGGER touch_updated_at BEFORE UPDATE ON dataholders.%I FOR EACH ROW EXECUTE FUNCTION meta.touch_updated_at()', t);
+    END LOOP;
+  END IF;
+END $$;
+--> statement-breakpoint
+-- Privacy (same as health): app role only, NOT granted to personal_ro, and not registered
+-- in meta.tables, so the generic list/table GUI never shows it.
+REVOKE ALL ON SCHEMA dataholders FROM PUBLIC;
+--> statement-breakpoint
+DO $$
+BEGIN
+  IF current_user = 'personal' AND EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'personal_app') THEN
+    GRANT USAGE ON SCHEMA dataholders TO personal_app;
+    GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA dataholders TO personal_app;
+    GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA dataholders TO personal_app;
+    ALTER DEFAULT PRIVILEGES FOR ROLE personal IN SCHEMA dataholders
+      GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO personal_app;
+    ALTER DEFAULT PRIVILEGES FOR ROLE personal IN SCHEMA dataholders
+      GRANT USAGE, SELECT ON SEQUENCES TO personal_app;
+  END IF;
+END $$;