Phase 2: Enforce Row-Level Security at the PostgreSQL level

- Rewrite rls.ts with withTenant()/withBypassRLS() using parameterized
  set_config() in interactive Prisma transactions (no SQL injection)
- Add FORCE ROW LEVEL SECURITY on all 15 tenant-scoped tables
- Add __bypass__ sentinel and WITH CHECK clauses to every RLS policy
- Explicitly DISABLE RLS on tenants, tenant_hostnames, sessions
- Wrap all API route and page loader queries in withTenant()
- Wrap validateSession() in withBypassRLS() (joins RLS-protected users)
- Keep existing tenantId where-clause filters as optimization layer
- Add postgresql-client to Dockerfile and auto-apply RLS via entrypoint

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Dockerfile

@@ -29,7 +29,9 @@ RUN npx prisma generate
 
 COPY --from=builder /app/build ./build
 COPY --from=builder /app/server.js ./server.js
+COPY scripts ./scripts
 
+RUN apk add --no-cache postgresql-client
 RUN apk del python3 make g++ && rm -rf /var/cache/apk/*
 RUN mkdir -p /app/uploads