Grant table privileges to the API roles in the initial migration

RLS policies only filter rows on top of table-level privileges —
Postgres checks the table ACL first and rejects with 42501 before RLS
is ever consulted. Supabase's stock default privileges normally paper
over this by auto-granting DML to the API roles, but that's a database
setting that can be hardened away, and then every query from the app
dies at the gate.

authenticated gets SELECT/UPDATE/DELETE on users (inserts happen via
the SECURITY DEFINER trigger on auth.users) and full DML on devices;
service_role gets full DML on both (it bypasses RLS, not the ACL).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: John Kealy

supabase/migrations/20260101120000_initial_schema.sql

@@ -104,6 +104,29 @@ CREATE POLICY "Users can delete their own devices"
     TO authenticated
     USING (auth.uid() = user_id);
 
+-- ============================================================================
+-- GRANTS FOR API ROLES
+-- ============================================================================
+-- RLS policies only filter rows on top of table-level privileges — they are
+-- not permissions themselves. Postgres checks the table ACL first and rejects
+-- queries with "permission denied" (42501) before RLS is even evaluated.
+-- Supabase's stock default privileges usually grant DML to the API roles
+-- automatically, but that's a database setting that can be (and sometimes is)
+-- hardened away, so this migration grants what it needs explicitly. Any future
+-- table needs its own GRANTs alongside its policies.
+
+-- users: policies exist for SELECT / UPDATE / DELETE (inserts happen via the
+-- SECURITY DEFINER trigger on auth.users, so authenticated needs no INSERT).
+GRANT SELECT, UPDATE, DELETE ON public.users TO authenticated;
+
+-- devices: the app upserts (SELECT + INSERT + UPDATE) and deletes push tokens.
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.devices TO authenticated;
+
+-- The backend connects as service_role, which bypasses RLS but still requires
+-- table-level privileges.
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.users TO service_role;
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.devices TO service_role;
+
 -- ============================================================================
 -- FUNCTIONS
 -- ============================================================================