Lock down your Supabase tables

Audit and fix Supabase Row Level Security (RLS) in this project. Write all changes as a new migration file.

1. INVENTORY
List every table in the public schema, whether RLS is enabled, and its current policies. Also list storage buckets and their policies, views, and database functions marked SECURITY DEFINER.

2. ENABLE RLS EVERYWHERE
Enable RLS on every table in the public schema. A table with RLS on and no policies is closed to the anon and authenticated roles, which is the safe default.

3. WRITE THE NARROWEST POLICIES THE APP NEEDS
Typical patterns:
- Private to the owner: allow select, insert, update and delete where user_id = auth.uid(). On insert and update use WITH CHECK (user_id = auth.uid()) so nobody can write rows for someone else.
- Shared within a team: allow access where the row's team_id is in the teams the user belongs to (use a membership table, not a column the user can edit).
- Public read-only (for example published posts): a select policy for anon with a condition such as published = true; no write policies for anon.
- Never use USING (true) or WITH CHECK (true) for insert, update or delete unless the table is meant to be publicly writable.
- Columns users must not change themselves (role, plan, credits, is_admin) must not be writable through an update policy: move them to a table only the server writes, or check them in WITH CHECK.

4. STORAGE
Add policies on storage.objects so users can only read and write files under their own folder (for example a path that starts with their user id), unless a bucket is meant to be public.

5. VIEWS AND FUNCTIONS
- Views: make them respect RLS (security_invoker = true) or remove access for anon.
- SECURITY DEFINER functions bypass RLS: check each one verifies the caller and sets a fixed search_path.

6. KEYS
Find any use of the service-role key outside server-side code (Edge Functions, API routes) and move it there.

Show me, per table, the policies before and after. When you're done: list every file you changed, explain each change in one line, and give me a step-by-step test for each numbered item above. Don't change anything unrelated.