Document additive ORM schema initialization

app/security/database.py

@@ -122,6 +122,13 @@ class SecurityDatabase:
         cursor.close()
 
     async def initialize(self) -> None:
+        """Create ORM-mapped tables and indexes that do not exist yet.
+
+        SQLAlchemy create_all is intentionally additive: it does not alter
+        existing columns or repair incompatible foreign keys. PostgreSQL RLS
+        policies and migration-only constraints must still be applied by SQL
+        migrations and are verified separately at startup.
+        """
         if not self.auto_migrate:
             return
         async with self.engine.begin() as connection: