Supabase Postgres + RLS — tenant isolation done right

service_role bypass, tenant-scoped policies, the IPv4 add-on trap, the pooler-vs-direct decision, and the static test that prevents cross-tenant leaks.