RLS policy allows arbitrary writes

A policy has two conditions: `using` controls which rows may be read and modified, `with check` controls which values may be written. Securing only the first leaves a table that looks properly locked down yet can be filled by anyone.

In practice: inserting rows with someone else's user ID, reassigning your own rows to another owner, or flooding a table with data that looks legitimate. Because reads stay correctly restricted, this often goes unnoticed for a long time.

Fix: always write `with check` and give it the same condition as `using`. For INSERT policies `with check` is the only condition that applies at all — there, `true` literally means open to everyone.