perf(rls): wrap current_setting()/auth.uid() in (select …) for per-statement evaluation

[dmitrymaranik]

Postgres re-evaluates a bare current_setting('app.tenant_id') / auth.uid() in an RLS policy once per row it scans. Wrapping it in a scalar subquery — (select current_setting('app.tenant_id')) — makes it an InitPlan the planner evaluates once per statement and caches. It's predicate-equivalent (row visibility unchanged) and the standard Postgres/Supabase RLS perf pattern.

This adds a migration wrapping the 5 affected policies:

• Predicate-equivalent — only when the call is evaluated changes (once per statement vs once per row).
• Covers USING and WITH CHECK.
• Verified with pgrls (an open-source RLS analyzer) on Postgres 16: the PERF001 findings clear to 0, nothing else changed.

Happy to adjust the migration filename/placement to your conventions.