Additive, nullable JSONB on users carrying a default-on disabled
allowlist for the optional (secondary) domains. NULL / empty / a key
set to true all read as enabled; a key set to false disables that
module. No backfill — every existing account reads all-on.
Core domains (weight, blood pressure, pulse, medications) are never
written here and have no toggle. cycle and coach keep their existing
source of truth and the column does not own them.
