Why a Supabase row-level security policy returns nothing, fails or leaks, measured on PostgreSQL 17 with Supabase's own roles and auth.uid(): ten causes.