Provenance row for one anonymous portal submission (chain V10) — PII
lives HERE and only here, so deleting it erases everything the portal
learned about the submitter. v1 collects NO email (the panel's
mail-bombing find — the notify-submitter feature waits for a
double-opt-in design); the column exists for that v2. ip_hash is a
truncated peppered HMAC — abuse telemetry, deliberately not an
identifier.