Restore and harden Row Level Security (RLS) policies (Critical Access…

[mertcano]

… Control)

This PR patches a critical Broken Access Control vulnerability in the database layer. Previously, a development migration (remove_rsl_policies_for_development) completely disabled Row Level Security (RLS) across the platform. As a result, the public anon key could be exploited to perform unauthorized CRUD operations on any user's wallets, transactions, and escrow agreements.

** Vulnerabilities & Anti-Patterns Remediated:**

• Broken Access Control / Disabled RLS (CRITICAL):
  With RLS disabled, the database lacked native authorization checks. Any client-side request could bypass application logic to read or modify sensitive financial records and escrow states belonging to other users.
  Fix: Introduced a new migration (20260813000000_restore_and_harden_rls_policies.sql) that completely re-enables RLS on profiles, wallets, transactions, escrow_agreements, and dispute_resolutions.

Key Code Changes:

• Re-enabled ROW LEVEL SECURITY across all primary data tables.
• Implemented strict auth.uid() = user_id binding for SELECT, INSERT, UPDATE, and DELETE actions on wallets and transactions.
• Secured the escrow_agreements table by verifying that the authenticated user (auth.uid()) owns either the depositor_wallet_id or the beneficiary_wallet_id via a nested EXISTS query before allowing read or mutation access.
• Revoked wide-open permissions that may have been incorrectly assigned to the anon role during the development phase.