fix(db): grant supabase_auth_admin access to tenant_users + set hook SECURITY DEFINER

The custom_access_token_hook was not SECURITY DEFINER and
supabase_auth_admin lacked SELECT on tenant_users/super_admins.
This caused the hook to silently fail (WHEN OTHERS handler),
so JWTs never got tenant_id/tenant_role claims — breaking all
RLS policies for every user.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: guillermoscript

supabase/migrations/20260405225017_fix_auth_hook_grants.sql

@@ -0,0 +1,19 @@
+-- =============================================================================
+-- Fix custom_access_token_hook permissions
+--
+-- Root cause: The JWT hook queries tenant_users and super_admins but
+-- supabase_auth_admin had no SELECT grant on those tables, AND the hook
+-- was not SECURITY DEFINER so RLS blocked the queries even with grants.
+-- The WHEN OTHERS handler swallowed the permission error, returning the
+-- event unchanged — so JWTs never got tenant_id, tenant_role, or
+-- user_role claims. This broke all RLS policies.
+--
+-- Fix: SECURITY DEFINER makes the hook run as postgres (bypasses RLS).
+-- Grants are kept as a safety net.
+-- =============================================================================
+
+GRANT SELECT ON public.tenant_users TO supabase_auth_admin;
+GRANT SELECT ON public.super_admins TO supabase_auth_admin;
+
+-- The hook must be SECURITY DEFINER to bypass RLS on tenant_users/super_admins
+ALTER FUNCTION public.custom_access_token_hook(jsonb) SECURITY DEFINER;