Five functions decide who may read a row in our app, and the answer for somebody else's row is 404

src/lib/auth.ts is 87 lines, imported by 37 files, and every authorisation question in the app goes through it. Three of its helpers answer notFound() rather than a 403, one of them writes on a read path, and one excludes a 30 KB column by name.