Harden RLS for analytics and audit tables

[optimystical]

Summary

• Enable row-level security on search_queries, affiliate_clicks, and system_jobs.
• Keep direct anon/authenticated table access closed for analytics, tracking, and worker audit data.
• Document that server routes, cron jobs, and workers should use service_role for these tables.

Security rationale

These tables can contain user-linked search text, IP/user-agent tracking metadata, conversion/order identifiers, worker parameters, and job errors. They should not be directly exposed through Supabase's public API surface without explicit policies.

This complements the existing RLS hardening work in #188 without touching the same profile/list/annotation policies.

Validation

• git diff --check

Refs #100