Consolidate RLS policies for query-plan efficiency

[NMSOfficial]

Security-critical RLS and column grants are now enforced, and all foreign keys have covering indexes. Supabase Performance Advisor still reports non-blocking policy-planning debt:

• auth_rls_initplan: wrap stable auth/helper calls in scalar subqueries such as (select auth.uid()) or (select public.is_current_account_active()) where query-plan testing confirms an InitPlan improvement.
• multiple_permissive_policies: replace overlapping FOR ALL management policies plus separate SELECT policies with distinct INSERT, UPDATE, and DELETE policies, or consolidate equivalent checks.
• Re-run EXPLAIN (ANALYZE, BUFFERS) with realistic school/student volumes before and after each policy family change.

This should be completed table family by table family in staging because broad policy rewrites can silently change authorization semantics. Do not weaken the active-account, school-membership, role or field-level protections added in migrations 0033–0035.

Priority order:

1. submissions / criterion_scores / writing_annotations / study_recommendations
2. profiles / student_classes / teacher relations
3. assignments / rubrics / catalog
4. notifications and lookup/content tables

Acceptance criteria:

• No authorization regression in student, teacher and super-admin tests.
• Supabase Performance Advisor no longer reports the targeted policy warnings.
• Query plans demonstrate lower repeated auth/helper evaluation at representative row counts.