tmp: add service_role grant, re-diagnose

Author: QA Runner

.github/workflows/diag.yml

@@ -24,6 +24,17 @@ jobs:
           supabase start
           DB_URL=$(supabase status -o json | jq -r '.DB_URL')
           psql "$DB_URL" -v ON_ERROR_STOP=1 -f backend/schema.sql
+          # schema.sql revokes client grants (anon/authenticated) but assumes a
+          # hosted Supabase where service_role already has full table access. On a
+          # fresh CLI stack loaded via psql, service_role gets no grants on the new
+          # public tables, so the backend (which queries as service_role) 500s with
+          # "permission denied for table ...". Restore the production posture.
+          psql "$DB_URL" -v ON_ERROR_STOP=1 <<'SQL'
+          GRANT USAGE ON SCHEMA public TO service_role;
+          GRANT ALL ON ALL TABLES IN SCHEMA public TO service_role;
+          GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO service_role;
+          GRANT ALL ON ALL FUNCTIONS IN SCHEMA public TO service_role;
+          SQL
 
       - name: Wire env + start backend
         run: |