Scope subscription access and RLS policies to the authenticated user

[jedpattersonpaddle]

Ticket

DX-1020

Reason for change

The Supabase SELECT policies on customers and subscriptions used using (true), letting any authenticated user read every customer's email and subscription rows via the Supabase REST API. cancelSubscription and getSubscription accepted any subscription ID without checking ownership, so an authenticated user could cancel or view another user's subscription.

What has been done

• New migration scopes the read policies to the caller's own customer record and explicitly enables RLS on both tables.
• cancelSubscription and getSubscription now verify the subscription belongs to the authenticated user's Paddle customer before acting.

Existing deployments need the new migration applied manually — redeploying the app does not touch the database.

How to test

1. Sign in as user A with an active subscription; confirm the dashboard still lists and cancels their own subscription.
2. Sign in as user B and call cancelSubscription/getSubscription with user A's subscription ID — both return a generic error.
3. As user B, query /rest/v1/customers and /rest/v1/subscriptions with the anon key and user B's access token — only user B's rows are returned.