-- JewelOS — secure production setup
-- Run supabase/migrations/001_lockdown_rls.sql, then
-- supabase/migrations/002_atomic_transactions.sql, in the Supabase SQL
-- Editor (or `supabase db push` from the repo). Both files are idempotent
-- and safe to re-run.
--
-- What they do, in short:
--   * Create store / auth_store / counters / login_attempts /
--     payment_events / password_reset_tokens.
--   * Enable Row Level Security on every one of them.
--   * Grant NOTHING to anon or authenticated — this is intentional.
--     There is no "USING (true)" policy anywhere in this schema.
--     Only the service_role key (used exclusively inside the
--     store-proxy / auth-gateway / razorpay-webhook Edge Functions,
--     never sent to the browser) can read or write these tables.
--   * Add increment_shop_counter() and store_cas_write(), the atomic
--     Postgres functions store-proxy calls for invoice/order/Girvi
--     numbering and for conflict-safe multi-device saves.
--
-- Then deploy the Edge Functions:
--   supabase functions deploy store-proxy
--   supabase functions deploy auth-gateway
--   supabase functions deploy razorpay-webhook
--
-- The browser only ever calls those three function URLs — never a
-- Supabase table URL (/rest/v1/...) directly.