POST /focus-mode-template/{template_id}/install

Per-entry categories for this block list: [{ entry, category }], where entry mirrors an allowed_urls / allowed_apps value and category is a client taxonomy id.

Encrypted like the other list columns, because the entries are the user's own blocked sites. Nullable with no SQL default on purpose: a plaintext '[]' default could not be read back through the encryption transformer, so "empty" is applied in code by the response serializer.

Deliberately outside MAX_ALLOWLIST_TOTAL_BYTES: that budget exists because a shared mode's allow-lists ride verbatim inside Pusher/FCM payloads, and categories never does — a class session snapshots only allowed_apps / allowed_urls. Anything that starts fanning the whole mode out over realtime must bring this column into that budget.

Platform identities for the app entries (allowed_apps, and on focus modes the Windows app's metadata.allowed_apps_win), keyed by entry like categories. Clients match the running app by these instead of a renameable name; entries with none are matched by name as before. Filled from the common-apps catalog on every write, so older clients that send names only still get them. Encrypted and nullable with no SQL default for the same reason as categories.