-- The plugin control plane is authenticated by E, but existing S transactions
-- require a UUID actor for foreign keys and role checks. This principal has no
-- credential row and is excluded from all user-management views.
INSERT INTO users (id, username, username_normalized, email, email_normalized, role, status)
VALUES (
  '00000000-0000-0000-0000-000000000036',
  '__plugin_service__',
  '__plugin_service__',
  'plugin-service@internal.invalid',
  'plugin-service@internal.invalid',
  'admin',
  'active'
)
ON CONFLICT (id) DO NOTHING;