fix: add RLS policies to 7 schemas missing tenant isolation

[Wachhund]

Summary

Adds Row Level Security (RLS) policies to 41 tables across 7 PostgreSQL schemas that were missing tenant isolation despite having tenant_id columns:

• social (20 tables): player_profiles, endorsement, leaderboard entries/scores, chat_channel, moderation, reputation, presence, etc.
• multiplayer (2 tables): party, coop_session
• billing (5 tables): subscriptions, seats, seat_history, stripe_customers, invoices
• feature_flags (3 tables): flags, tenant_overrides, ab_test_assignments
• lrs (4 tables): scorm_packages, scorm_registrations, xapi_statements, xapi_lrs_config
• lti (5 tables): lti_platforms, lti_deep_link_content, lti_line_items, lti_scores, lti_sessions
• audit (2 tables): logs, retention_config

Tables without tenant_id are intentionally excluded (e.g. achievement_icon, endorsement_tags, plans, webhook_events, lti_nonces, lti_states, coop_scenario, party_member, etc.).

All policies use the same idempotent pattern as migration 0021:

• ENABLE ROW LEVEL SECURITY
• Idempotent policy creation with IF NOT EXISTS
• USING and WITH CHECK clauses referencing auth.current_tenant_id()
• Super admin bypass via app.is_super_admin session variable
• FORCE ROW LEVEL SECURITY to prevent table owner bypass

Test plan

• Migration applies cleanly on a fresh database
• Migration is idempotent (can be run twice without error)
• RLS policies are visible via SELECT * FROM pg_policies
• Queries without tenant context return empty results
• Super admin bypass works correctly