-- Add allowed_categories column to admin_accounts
-- NULL = access to all categories (super_admin / admin behavior)
-- JSON array of category IDs = restricted access e.g. [1, 3, 5]
ALTER TABLE admin_accounts
  ADD COLUMN IF NOT EXISTS allowed_categories JSON NULL DEFAULT NULL
  COMMENT 'NULL = all categories. JSON array of category IDs for restricted access.';