feat(tenancy): guard test – every app table has forced RLS #29

Goal

A new table can never silently skip tenant isolation: CI fails when any table in schema app lacks forced RLS or a company policy.

Acceptance criteria

• Integration test enumerates all tables in schema app (pg_class/pg_policy) and asserts RLS enabled + forced and a company_id policy
• Documented allow-list for tables that are deliberately global (empty by default; each entry needs a reason)
• Runs in verify

Not part of this task

• Changing existing policies

Affected areas

• src/features/tenancy/
• tests/integration/

Test plan

Security/Privacy affected?

Yes – tenant isolation (ADR-0001 D7).

Epic: #18 · Architecture: docs/decisions/ADR-0001-pilot-architecture.md