-- Migration 007: ACH payment provider reference and masked account.
-- Tokens/references only, never raw bank numbers. MySQL syntax (not MariaDB).

ALTER TABLE payments
    ADD COLUMN gateway_reference VARCHAR(100) NULL AFTER status,
    ADD COLUMN account_last4 VARCHAR(4) NULL AFTER gateway_reference;