fix(rls): payment RLS verified — correct stale audit-log assertion

[TortoiseWolfe]

Summary

• Verified all 20+ payment RLS policies via pnpm test:rls against both local Supabase profile and cloud — 55/55 tests pass on both.
• Fixed one stale assertion in tests/rls/service-role.test.ts that encoded a non-existent contract (auto-instrumented signup audit logs).
• No policy changes were needed.

Closes #44.

What changed

tests/rls/service-role.test.ts — the "service role can read all audit logs" test asserted ≥2 rows on the basis of "signup events from user creation," but the monolithic schema has no trigger that writes `auth_audit_logs` rows on `auth.users` INSERT. The policy under test is "service role can SELECT all audit logs"; verifying that needs only `≥1` row, which T032 reliably inserts immediately above. Updated the assertion + comment.

What didn't change

The 20+ payment RLS policies in supabase/migrations/20251006_complete_monolithic_setup.sql are correct as written. They enforce exactly what features/payments/042-payment-rls-policies/spec.md claims.

Test plan

• docker compose --profile supabase up -d — local supabase stack healthy
• docker compose exec supabase-db psql -c "SELECT COUNT(*) FROM pg_policies WHERE tablename IN ('payment_intents','payment_results','subscriptions','webhook_events','payment_provider_config');" — returns 17 (matches spec: 5+5+4+2+1)
• pnpm test:rls against local Supabase: 5 files, 55/55 tests pass
• pnpm test:rls against cloud Supabase: 5 files, 55/55 tests pass (24s vs 4s local — network latency)
• Idempotent: re-running pnpm test:rls immediately a second time also passes (cleanup in afterAll works)

Follow-ups (filed separately, not bundled here)

• [Gap-Audit] auth_audit_logs sign_up events not written for all signup paths #49 — auth_audit_logs sign_up event instrumentation gap (P2). The fix to this test is correct, but the intended feature (auto-write on signup) is real and unimplemented.
• [Gap-Audit] RLS test suite wedges on cloud Supabase when prior runs leave residue #50 — RLS test fixture cleanup-stale hook (P2). Cloud had stale *@scripthammer.test users + orphan FKs from a 2026-04-16 run; needed manual scrub before the cloud run could pass. A globalSetup hook would prevent that.

🤖 Generated with Claude Code