feat: tenant isolation Phase 4 — RLS on 31 remaining tables + script_builder fix
Enable RLS on all remaining tenant-scoped tables (31 tables):
Standard policy (tenant sees own rows):
users, account_invites, account_limit_overrides, account_feature_overrides,
subscriptions, ai_chat_sessions, ai_conversations, ai_session_steps,
ai_session_embeddings, ai_suggestions, ai_usage, assistant_chats,
attachments, copilot_conversations, feedback, file_uploads, fork_points,
kb_imports, notifications, notification_configs, notification_logs,
psa_activity_logs, psa_member_mappings, script_builder_sessions,
script_categories, session_ratings, tree_embeddings, user_folders,
user_pinned_trees
Platform-visibility policy (own rows OR PLATFORM_ACCOUNT_ID):
platform_steps, template_trees
Intentionally skipped:
accounts (IS the root table, no account_id column)
plan_feature_defaults (platform config, no account_id column)
Also fixes script_builder_service.create_session() which was missing
account_id= on ScriptBuilderSession construction, causing 500s on all
script builder endpoints (pre-existing CI failure).
Adds Phase 4 RLS isolation tests covering: users, script_builder_sessions,
ai_session_steps, notifications, platform_steps, template_trees.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
64f004a62c