RLS is now enabled on the users table. The seed script was using the app-role connection (DATABASE_URL) which has no tenant context at seed time — all SELECTs return 0 rows and INSERTs are blocked by FORCE RLS. Falls back to DATABASE_URL if ADMIN_DATABASE_URL is not set (local dev without roles configured). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>