Phase 2: Enforce Row-Level Security at the PostgreSQL level

- Rewrite rls.ts with withTenant()/withBypassRLS() using parameterized
  set_config() in interactive Prisma transactions (no SQL injection)
- Add FORCE ROW LEVEL SECURITY on all 15 tenant-scoped tables
- Add __bypass__ sentinel and WITH CHECK clauses to every RLS policy
- Explicitly DISABLE RLS on tenants, tenant_hostnames, sessions
- Wrap all API route and page loader queries in withTenant()
- Wrap validateSession() in withBypassRLS() (joins RLS-protected users)
- Keep existing tenantId where-clause filters as optimization layer
- Add postgresql-client to Dockerfile and auto-apply RLS via entrypoint

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-entrypoint.sh

@@ -20,5 +20,12 @@ if [ $RETRY -ge $MAX_RETRIES ]; then
   exit 1
 fi
 
+echo "Applying RLS policies..."
+if psql "$DATABASE_URL" -f ./scripts/setup-rls.sql; then
+  echo "RLS policies applied successfully."
+else
+  echo "WARNING: Failed to apply RLS policies. Continuing anyway..."
+fi
+
 echo "Starting server..."
 exec node server.js