Lock down OAuth used codes table (#641)

* Lock down OAuth used codes table

* test(db): lock oauth_used_codes lockdown contract + reload PostgREST cache

Add a pg-real test asserting anon/authenticated are denied SELECT/INSERT on
public.oauth_used_codes while the privileged (service-role) connection can
still read it, per the project's requirement that RLS changes ship a
*.pg.test.ts. Also append NOTIFY pgrst, 'reload schema' so PostgREST picks up
the privilege change immediately (migration rule 8).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Jakob Wennberg <jakob.wennberg@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

supabase/migrations/20260602145425_lock_down_oauth_used_codes.sql

@@ -0,0 +1,9 @@
+-- OAuth authorization-code replay tracking is internal-only. The token
+-- endpoint uses a service-role client, so browser-facing API roles must not
+-- access this table.
+ALTER TABLE public.oauth_used_codes ENABLE ROW LEVEL SECURITY;
+
+REVOKE ALL ON TABLE public.oauth_used_codes FROM anon, authenticated;
+
+-- Privilege change: tell PostgREST to reload its schema/role cache.
+NOTIFY pgrst, 'reload schema';