fix: add chat session delete row policy (#21)

frontend/supabase/migrations/20260721100000_chat_sessions_delete_grant.sql

@@ -1,5 +1,12 @@
 begin;
 
+drop policy if exists chat_sessions_delete_own on public.chat_sessions;
+create policy chat_sessions_delete_own
+  on public.chat_sessions
+  for delete
+  to authenticated
+  using ((select auth.uid()) = user_id);
+
 grant delete on table public.chat_sessions to authenticated;
 
 commit;

tests/test_session_management_entrypoints.py

@@ -45,3 +45,5 @@ def test_chat_session_delete_is_server_controlled_and_granted() -> None:
     assert '.eq("user_id", user.id)' in route
     assert 'count !== 1' in route
     assert 'grant delete on table public.chat_sessions to authenticated' in migration.lower()
+    assert 'create policy chat_sessions_delete_own' in migration.lower()
+    assert 'using ((select auth.uid()) = user_id)' in migration.lower()