fix(account): grant service_role ayanamsa for new-user profile saves (BUG-600)

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/supabase/migrations/20260909010000_profile_ayanamsa_service_role_grants.sql

@@ -0,0 +1,10 @@
+begin;
+
+-- BUG-600: account PATCH uses service_role. The ayanamsa column only granted
+-- UPDATE to authenticated, so the first onboarding save (which always sends
+-- ayanamsa) failed with "permission denied for table profiles".
+grant select (ayanamsa) on table public.profiles to service_role;
+grant insert (ayanamsa) on table public.profiles to service_role;
+grant update (ayanamsa) on table public.profiles to service_role;
+
+commit;

frontend/tests/profile-persistence.test.ts

@@ -141,3 +141,24 @@ test("declared birth windows persist as start and end clocks with service-role g
     false,
   );
 });
+
+test("service role can persist ayanamsa during account profile upserts", () => {
+  const original = readFileSync(
+    new URL("../supabase/migrations/20260903010000_profile_ayanamsa.sql", import.meta.url),
+    "utf8",
+  );
+  const repair = readFileSync(
+    new URL(
+      "../supabase/migrations/20260909010000_profile_ayanamsa_service_role_grants.sql",
+      import.meta.url,
+    ),
+    "utf8",
+  );
+
+  assert.match(original, /grant update \(ayanamsa\) on table public\.profiles to authenticated/);
+  assert.doesNotMatch(original, /to service_role/);
+  assert.match(repair, /grant select \(\s*ayanamsa\s*\) on table public\.profiles to service_role/i);
+  assert.match(repair, /grant insert \(\s*ayanamsa\s*\) on table public\.profiles to service_role/i);
+  assert.match(repair, /grant update \(\s*ayanamsa\s*\) on table public\.profiles to service_role/i);
+});
+