Dropping anon CRUD policies on service-role-only tables

I had 22 RLS policies granting public role CRUD access to six tables that should have been service-role-only. The sharpest exposure was social_accounts, where OAuth tokens were anon-SELECT readable.

The fix

I dropped all 22 policies via the Supabase SQL editor in production, then created database/057_drop_anon_crud_policies.sql as the committed record. The file uses DROP POLICY IF EXISTS so re-running is a no-op. RLS stays enabled on all six tables (admin_panels, cc_sessions, headroom_snapshots, social_accounts, social_posts, social_templates), which means anon is now deny-all. Service role is unaffected.

Second export entry point

I added an Export Data option to the three-dot menu on each org card in the Organizations list page. The existing export card on the edit page is unchanged.

I pulled the shared logic into a new useOrgExport hook that handles confirmation, the dialog, blob download, and exporting state. The edit-page card refactored onto it. The one difference between the two call sites is error handling: the edit card shows an inline error box, the list page shows a toast. I pass that in via an onError callback.

The three-dot menu closes when you dismiss the confirm dialog, so I couldn't put a spinner inside the menu. I swap the three-dot icon for a spinner and disable the button so the busy state survives the menu closing.