Supabase RLS policies that pass review but still leak data

Two Supabase RLS policy shapes that look secure and still leak: auth.uid() is not null, and free credits keyed on raw emails. SQL to find and fix both.