perf(rls): wrap auth.uid()/current_setting() in (select …) for per-statement evaluation

supabase/migrations/20260628093438_wrap_rls_perf_initplan.sql

@@ -0,0 +1,13 @@
+-- Wrap auth.uid()/current_setting() in RLS policy predicates in (select ...) so
+-- Postgres evaluates each once per statement (an InitPlan) instead of once per row --
+-- the Supabase-documented RLS perf pattern. Covers USING and WITH CHECK. Predicate-
+-- equivalent (row visibility unchanged). Generated by 'pgrls fix --rule PERF001'
+-- (pgrls 0.44.0) and verified on Postgres 16 (PERF001 -> 0).
+
+-- [PERF001] Wrap auth function call(s) in policy 'Users can insert documents' on public.documents so Postgres can cache the result for the whole statement instead of re-evaluating per row.
+ALTER POLICY "Users can insert documents" ON public.documents
+    WITH CHECK ((SELECT auth.uid()) = created_by);
+
+-- [PERF001] Wrap auth function call(s) in policy 'Users can query their own documents' on public.documents so Postgres can cache the result for the whole statement instead of re-evaluating per row.
+ALTER POLICY "Users can query their own documents" ON public.documents
+    USING ((SELECT auth.uid()) = created_by);