Fix missing or useless Row Level Security (Supabase)

Rules: `db/rls-not-enabled` (critical), `db/permissive-policy` (high), `db/rls-no-policy` (medium)

Only runs on projects that use Supabase; on server-only database setups missing RLS is expected, so the tool stays quiet.

What muster-check saw

``` CRIT Table "orders" has no Row Level Security supabase/migrations/0001_init.sql:1 create table orders HIGH Row Level Security policy allows every row supabase/migrations/0001_init.sql:4 USING (true) ```

Fix

```sql alter table orders enable row level security;

create policy "owners read own orders" on orders for select using (auth.uid() = user_id); create policy "owners insert own orders" on orders for insert with check (auth.uid() = user_id); ```

• `USING (true)` matches every row for every caller: same as no RLS. Scope it to `auth.uid()`.
• RLS enabled with no policy denies everyone: safe but the table is unusable; add policies.

Prove it's fixed (the two-account test, local)

1. Run `supabase start` locally; apply the migration.
2. Create users A and B; insert a row as A.
3. As B (B's JWT + anon key), `GET /rest/v1/orders?select=*`. Expect zero rows of A's data. Before the fix, B sees them.
4. Write the two requests into a test so it fails if RLS is dropped later.

Limits

muster-check reads migrations only. It cannot tell whether your `auth.uid() = user_id` column is the right one, or whether dashboard-created tables match your migrations. The two-account test is what proves it.