phase12: disable RLS on tax_rates (startup table)

alembic/versions/0077_disable_rls_tax_rates.py

@@ -0,0 +1,25 @@
+"""Disable RLS on tax_rates table (read at startup without tenant context).
+
+Revision ID: 0077
+Revises: 0076
+"""
+from alembic import op
+from sqlalchemy import text
+
+revision = "0077"
+down_revision = "0076"
+branch_labels = None
+depends_on = None
+
+def upgrade() -> None:
+    op.execute("DROP POLICY IF EXISTS tax_rates_tenant_isolation ON tax_rates")
+    op.execute("ALTER TABLE tax_rates DISABLE ROW LEVEL SECURITY")
+
+def downgrade() -> None:
+    op.execute("ALTER TABLE tax_rates ENABLE ROW LEVEL SECURITY")
+    op.execute(
+        "CREATE POLICY tax_rates_tenant_isolation ON tax_rates "
+        "FOR ALL "
+        "USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid) "
+        "WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid)"
+    )