perf: add secondary FK indexes to core OSS schemas

Add 13 secondary indexes across 10 tables in the SQLite schema and
5 missing indexes to the PostgreSQL schema.

All list endpoints (listSites, listResources, listClients, listRoles,
listTargets, listUserOrgs) filter and join on these FK columns. In the
SQLite schema, no secondary indexes existed at all on these foreign keys,
forcing full sequential scans on every paginated request and session lookup.

SQLite changes (13 new indexes):
  - sites.orgId
  - resources.orgId
  - targets.resourceId, targets.siteId
  - newt.siteId
  - clients.orgId, clients.userId
  - labels.orgId
  - olms.userId
  - session.userId
  - userOrgs.userId, userOrgs.orgId
  - roles.orgId

PG changes (5 new indexes, rest already present):
  - labels.orgId
  - session.userId
  - userOrgs.userId, userOrgs.orgId
  - roles.orgId
  - olms.userId

server/db/pg/schema/schema.ts

@@ -262,7 +262,9 @@ export const resourceAiModels = pgTable(
     (t) => [primaryKey({ columns: [t.resourceId, t.modelId] })]
 );
 
-export const labels = pgTable("labels", {
+export const labels = pgTable(
+    "labels",
+    {
         labelId: serial("labelId").primaryKey(),
         name: varchar("name").notNull(),
         color: varchar("color").notNull(),
@@ -271,7 +273,9 @@ export const labels = pgTable("labels", {
                 onDelete: "cascade"
             })
             .notNull()
-});
+    },
+    (t) => [index("idx_labels_orgid").on(t.orgId)]
+);
 
 export const launcherViews = pgTable("launcherViews", {
     viewId: serial("viewId").primaryKey(),
@@ -693,7 +697,9 @@ export const twoFactorBackupCodes = pgTable("twoFactorBackupCodes", {
     codeHash: varchar("codeHash").notNull()
 });
 
-export const sessions = pgTable("session", {
+export const sessions = pgTable(
+    "session",
+    {
         sessionId: varchar("id").primaryKey(),
         userId: varchar("userId")
             .notNull()
@@ -701,7 +707,9 @@ export const sessions = pgTable("session", {
         expiresAt: bigint("expiresAt", { mode: "number" }).notNull(),
         issuedAt: bigint("issuedAt", { mode: "number" }),
         deviceAuthUsed: boolean("deviceAuthUsed").notNull().default(false)
-});
+    },
+    (t) => [index("idx_sessions_userid").on(t.userId)]
+);
 
 export const newtSessions = pgTable("newtSession", {
     sessionId: varchar("id").primaryKey(),
@@ -711,7 +719,9 @@ export const newtSessions = pgTable("newtSession", {
     expiresAt: bigint("expiresAt", { mode: "number" }).notNull()
 });
 
-export const userOrgs = pgTable("userOrgs", {
+export const userOrgs = pgTable(
+    "userOrgs",
+    {
         userId: varchar("userId")
             .notNull()
             .references(() => users.userId, { onDelete: "cascade" }),
@@ -723,7 +733,12 @@ export const userOrgs = pgTable("userOrgs", {
         isOwner: boolean("isOwner").notNull().default(false),
         autoProvisioned: boolean("autoProvisioned").default(false),
         pamUsername: varchar("pamUsername") // cleaned username for ssh and such
-});
+    },
+    (t) => [
+        index("idx_userOrgs_userid").on(t.userId),
+        index("idx_userOrgs_orgid").on(t.orgId)
+    ]
+);
 
 export const emailVerificationCodes = pgTable("emailVerificationCodes", {
     codeId: serial("id").primaryKey(),
@@ -751,7 +766,9 @@ export const actions = pgTable("actions", {
     description: varchar("description")
 });
 
-export const roles = pgTable("roles", {
+export const roles = pgTable(
+    "roles",
+    {
         roleId: serial("roleId").primaryKey(),
         orgId: varchar("orgId")
             .references(() => orgs.orgId, {
@@ -766,7 +783,9 @@ export const roles = pgTable("roles", {
         sshSudoCommands: text("sshSudoCommands").default("[]"),
         sshCreateHomeDir: boolean("sshCreateHomeDir").default(true),
         sshUnixGroups: text("sshUnixGroups").default("[]")
-});
+    },
+    (t) => [index("idx_roles_orgid").on(t.orgId)]
+);
 
 export const userOrgRoles = pgTable(
     "userOrgRoles",
@@ -1409,7 +1428,10 @@ export const olms = pgTable(
         }),
         archived: boolean("archived").notNull().default(false)
     },
-    (t) => [index("idx_olms_clientid").on(t.clientId)]
+    (t) => [
+        index("idx_olms_clientid").on(t.clientId),
+        index("idx_olms_userid").on(t.userId)
+    ]
 );
 
 export const currentFingerprint = pgTable("currentFingerprint", {

server/db/sqlite/schema/schema.ts

@@ -99,7 +99,9 @@ export const orgDomains = sqliteTable("orgDomains", {
         .references(() => domains.domainId, { onDelete: "cascade" })
 });
 
-export const sites = sqliteTable("sites", {
+export const sites = sqliteTable(
+    "sites",
+    {
         siteId: integer("siteId").primaryKey({ autoIncrement: true }),
         orgId: text("orgId")
             .references(() => orgs.orgId, {
@@ -141,10 +143,18 @@ export const sites = sqliteTable("sites", {
         })
             .notNull()
             .default(false),
-    status: text("status").$type<"pending" | "approved">().default("approved")
+        status: text("status")
-});
+            .$type<"pending" | "approved">()
+            .default("approved")
+    },
+    (table) => [
+        index("idx_sites_orgId").on(table.orgId)
+    ]
+);
 
-export const resources = sqliteTable("resources", {
+export const resources = sqliteTable(
+    "resources",
+    {
         resourceId: integer("resourceId").primaryKey({ autoIncrement: true }),
         resourcePolicyId: integer("resourcePolicyId").references(
             () => resourcePolicies.resourcePolicyId,
@@ -222,8 +232,14 @@ export const resources = sqliteTable("resources", {
             .$type<"site" | "remote" | "native">()
             .default("site"),
         authDaemonPort: integer("authDaemonPort").default(22123),
-    status: text("status").$type<"pending" | "approved">().default("approved")
+        status: text("status")
-});
+            .$type<"pending" | "approved">()
+            .default("approved")
+    },
+    (table) => [
+        index("idx_resources_orgId").on(table.orgId)
+    ]
+);
 
 export const resourceAiProviders = sqliteTable(
     "resourceAiProviders",
@@ -260,7 +276,9 @@ export const resourceAiModels = sqliteTable(
     (t) => [primaryKey({ columns: [t.resourceId, t.modelId] })]
 );
 
-export const labels = sqliteTable("labels", {
+export const labels = sqliteTable(
+    "labels",
+    {
         labelId: integer("labelId").primaryKey({ autoIncrement: true }),
         name: text("name").notNull(),
         color: text("color").notNull(),
@@ -269,7 +287,11 @@ export const labels = sqliteTable("labels", {
                 onDelete: "cascade"
             })
             .notNull()
-});
+    },
+    (table) => [
+        index("idx_labels_orgId").on(table.orgId)
+    ]
+);
 
 export const launcherViews = sqliteTable("launcherViews", {
     viewId: integer("viewId").primaryKey({ autoIncrement: true }),
@@ -366,14 +388,18 @@ export const clientLabels = sqliteTable(
     (t) => [unique("client_label_uniq").on(t.clientId, t.labelId)]
 );
 
-export const targets = sqliteTable("targets", {
+export const targets = sqliteTable(
+    "targets",
+    {
         targetId: integer("targetId").primaryKey({ autoIncrement: true }),
-    resourceId: integer("resourceId").references(() => resources.resourceId, {
+        resourceId: integer("resourceId").references(
-        onDelete: "cascade"
+            () => resources.resourceId,
-    }),
+            { onDelete: "cascade" }
-    providerId: integer("providerId").references(() => aiProviders.providerId, {
+        ),
-        onDelete: "cascade"
+        providerId: integer("providerId").references(
-    }),
+            () => aiProviders.providerId,
+            { onDelete: "cascade" }
+        ),
         siteId: integer("siteId")
             .references(() => sites.siteId, {
                 onDelete: "cascade"
@@ -394,7 +420,12 @@ export const targets = sqliteTable("targets", {
             .notNull()
             .default("http"),
         authToken: text("authToken")
-});
+    },
+    (table) => [
+        index("idx_targets_resourceId").on(table.resourceId),
+        index("idx_targets_siteId").on(table.siteId)
+    ]
+);
 
 export const targetHealthCheck = sqliteTable("targetHealthCheck", {
     targetHealthCheckId: integer("targetHealthCheckId").primaryKey({
@@ -663,7 +694,9 @@ export const setupTokens = sqliteTable("setupTokens", {
     dateUsed: text("dateUsed")
 });
 
-export const newts = sqliteTable("newt", {
+export const newts = sqliteTable(
+    "newt",
+    {
         newtId: text("id").primaryKey(),
         secretHash: text("secretHash").notNull(),
         dateCreated: text("dateCreated").notNull(),
@@ -671,9 +704,15 @@ export const newts = sqliteTable("newt", {
         siteId: integer("siteId").references(() => sites.siteId, {
             onDelete: "cascade"
         })
-});
+    },
+    (table) => [
+        index("idx_newts_siteId").on(table.siteId)
+    ]
+);
 
-export const clients = sqliteTable("clients", {
+export const clients = sqliteTable(
+    "clients",
+    {
         clientId: integer("clientId").primaryKey({ autoIncrement: true }),
         orgId: text("orgId")
             .references(() => orgs.orgId, {
@@ -706,7 +745,12 @@ export const clients = sqliteTable("clients", {
         approvalState: text("approvalState").$type<
             "pending" | "approved" | "denied"
         >()
-});
+    },
+    (table) => [
+        index("idx_clients_orgId").on(table.orgId),
+        index("idx_clients_userId").on(table.userId)
+    ]
+);
 
 export const clientSitesAssociationsCache = sqliteTable(
     "clientSitesAssociationsCache",
@@ -734,7 +778,9 @@ export const clientSiteResourcesAssociationsCache = sqliteTable(
     }
 );
 
-export const olms = sqliteTable("olms", {
+export const olms = sqliteTable(
+    "olms",
+    {
         olmId: text("id").primaryKey(),
         secretHash: text("secretHash").notNull(),
         dateCreated: text("dateCreated").notNull(),
@@ -750,7 +796,11 @@ export const olms = sqliteTable("olms", {
             onDelete: "cascade"
         }),
         archived: integer("archived", { mode: "boolean" }).notNull().default(false)
-});
+    },
+    (table) => [
+        index("idx_olms_userId").on(table.userId)
+    ]
+);
 
 export const currentFingerprint = sqliteTable("currentFingerprint", {
     fingerprintId: integer("id").primaryKey({ autoIncrement: true }),
@@ -912,7 +962,9 @@ export const twoFactorBackupCodes = sqliteTable("twoFactorBackupCodes", {
     codeHash: text("codeHash").notNull()
 });
 
-export const sessions = sqliteTable("session", {
+export const sessions = sqliteTable(
+    "session",
+    {
         sessionId: text("id").primaryKey(),
         userId: text("userId")
             .notNull()
@@ -922,7 +974,11 @@ export const sessions = sqliteTable("session", {
         deviceAuthUsed: integer("deviceAuthUsed", { mode: "boolean" })
             .notNull()
             .default(false)
-});
+    },
+    (table) => [
+        index("idx_sessions_userId").on(table.userId)
+    ]
+);
 
 export const newtSessions = sqliteTable("newtSession", {
     sessionId: text("id").primaryKey(),
@@ -940,7 +996,9 @@ export const olmSessions = sqliteTable("clientSession", {
     expiresAt: integer("expiresAt").notNull()
 });
 
-export const userOrgs = sqliteTable("userOrgs", {
+export const userOrgs = sqliteTable(
+    "userOrgs",
+    {
         userId: text("userId")
             .notNull()
             .references(() => users.userId, { onDelete: "cascade" }),
@@ -954,7 +1012,12 @@ export const userOrgs = sqliteTable("userOrgs", {
             mode: "boolean"
         }).default(false),
         pamUsername: text("pamUsername") // cleaned username for ssh and such
-});
+    },
+    (table) => [
+        index("idx_userOrgs_userId").on(table.userId),
+        index("idx_userOrgs_orgId").on(table.orgId)
+    ]
+);
 
 export const emailVerificationCodes = sqliteTable("emailVerificationCodes", {
     codeId: integer("id").primaryKey({ autoIncrement: true }),
@@ -982,7 +1045,9 @@ export const actions = sqliteTable("actions", {
     description: text("description")
 });
 
-export const roles = sqliteTable("roles", {
+export const roles = sqliteTable(
+    "roles",
+    {
         roleId: integer("roleId").primaryKey({ autoIncrement: true }),
         orgId: text("orgId")
             .references(() => orgs.orgId, {
@@ -1001,7 +1066,11 @@ export const roles = sqliteTable("roles", {
             true
         ),
         sshUnixGroups: text("sshUnixGroups").default("[]")
-});
+    },
+    (table) => [
+        index("idx_roles_orgId").on(table.orgId)
+    ]
+);
 
 export const userOrgRoles = sqliteTable(
     "userOrgRoles",