feat(db): complete PostgreSQL RLS rollout by access family

[tiankaima]

目标

按数据访问场景完成 PostgreSQL RLS：普通用户只能访问有权限的数据，公开内容保持可读；应用运行、登录、导入和 migration 各用最小权限的数据库身份。

当前进度

• 生产 Hyperdrive 已改用不具备 BYPASSRLS 的运行角色；用户身份在短事务内设置，不跨请求缓存。
• Todo、个人偏好、Upload、HomeworkCompletion、CommentReaction、UserSectionSubscription、UserUstcIdentity、Comment 等表已有 RLS 规则和隔离测试。
• 数据库权限、角色及规则有自动化检查，跨用户访问、伪造 owner 和连接复用已有针对性测试。

剩余工作

• 补齐目录与导入数据、Description/Homework 等协作内容的访问规则，明确匿名用户、普通用户、受限用户和管理员分别能读写什么。
• 为每张业务表明确负责访问的数据库角色，检查 Better Auth、应用运行、导入和 migration 的权限边界。
• 核对生产环境实际绑定的角色与预期一致。

验收

• 每张业务表都有明确的访问场景和负责角色；未授权访问默认拒绝。
• 跨用户访问、伪造 owner、级联操作和连接复用的测试通过。
• 公开读取与协作内容正常工作，且不会扩大 Better Auth 的数据库权限。

[tiankaima]

2026-07-22 follow-up audit

Further RLS activation is blocked by #603: the production Hyperdrive configuration currently reports origin user postgres with caching enabled. The database role attributes still need an origin-side audit, but production must move to a cache-disabled, least-privilege NOBYPASSRLS runtime identity before another policy family is enabled.

The next pure-owner family is also missing from the original inventory: Prisma's implicit _UserCalendarSections join stores user section subscriptions. Its services currently use nested connect/disconnect and getPrisma(locale) outside withUserDbContext. The safe sequence is to make this join an explicit UserSectionSubscription(userId, sectionId) model, route reads/writes through an exact transaction client, migrate data, test parity, and only then activate owner RLS.

Additional rollout gates found:

• run representative REST/GraphQL/MCP services under the runtime role, not only direct delegate tests; current bus preference service also reads BusCampus, which the CI runtime role does not grant;
• add pg_catalog policy/role/grant assertions and cross-owner UPDATE/DELETE/updateMany/deleteMany coverage;
• make future multi-table RLS migrations explicitly transactional;
• do not grant broad User, AuditLog, or UserSuspension table access to the app runtime; use narrow views/functions or service identities;
• getPrisma(locale) currently caches an extended client outside the active RLS transaction, so it must be made context-aware before protecting localized/nested paths;
• Upload/HomeworkCompletion remain mixed-visibility families and require narrow public entitlement/aggregate interfaces before owner policies.

[github-actions]

🎉 This issue has been resolved in version 1.84.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀