Make plaintext token column not null, add new token_encrypted column and
index on project_id & token_encrypted.

Post deployment migration to encrypt existing tokens.