* Lock down OAuth used codes table
* test(db): lock oauth_used_codes lockdown contract + reload PostgREST cache
Add a pg-real test asserting anon/authenticated are denied SELECT/INSERT on
public.oauth_used_codes while the privileged (service-role) connection can
still read it, per the project's requirement that RLS changes ship a
*.pg.test.ts. Also append NOTIFY pgrst, 'reload schema' so PostgREST picks up
the privilege change immediately (migration rule 8).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Jakob Wennberg <jakob.wennberg@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Joachim Hesthammer
5aa449ad3c