Four Supabase row-level security policy sets, tested with Supabase's own roles: own rows, public read, teams without recursion, and admins from the JWT.