Release-hardening pass (2026-08-06): applies persistent_projects. migrate_add_deletion_capability_token() to the REAL production DATABASE_URL. Same mirror-image safety rule as admin_apply_project_type_migration above (refuses to run if REHEARSAL_DATABASE_URL is set, to avoid ambiguity about which database is being targeted).

Purely additive: ADD COLUMN IF NOT EXISTS deletion_token_hash TEXT, nullable. Touches zero existing rows' data -- every existing project (anonymous or authenticated) gets deletion_token_hash = NULL, which can never match any supplied token, so nothing becomes retroactively deletable by this migration alone. Idempotent, safe to call more than once. Rehearsed against a throwaway Postgres (see /admin/project_migration_rehearsal, which now also exercises the full anonymous deletion-token create/wrong-token/correct-token/pre- migration-NULL matrix) before this endpoint is ever invoked against production.