fix: enforce RLS on internal metrics table

[SamOkampo]

Summary

Hardens the internal public.airdows_daily_metrics table so recreating or initializing it cannot leave browser-facing Supabase roles with direct table access.

Changes

• schema-qualifies creation as public.airdows_daily_metrics
• enables Row Level Security during MetricsStore.initialize()
• revokes all table privileges from anon
• revokes all table privileges from authenticated
• does not create public policies
• does not revoke or modify postgres or service_role
• adds focused tests for initialization order and backend read/write behavior

Scope

Only:

• metrics-store.js
• test/metrics-store-security.test.js

No changes to WebRTC, Socket.IO, TURN, transfer logic, PR #25, analytics, or the admin dashboard.

Production context

The Supabase table was manually hardened already by enabling RLS and removing anon / authenticated privileges. This PR makes that security posture repeatable if the table is recreated or initialized again.

Validation

GitHub Actions should run the repository unit, syntax, whitespace and critical E2E checks on this PR. No public RLS policies are introduced.

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing