Harden public catalog RLS boundaries

[zaixincheng174-ai]

Summary

• enable RLS on public catalog tables that can contain organization-scoped B2B rows (authors, books, translations, files, ISBNs, categories, and book-category links)
• allow direct client reads only for the public catalog (organization_id IS NULL) while leaving catalog writes to server/service-role paths
• make catalog views security-invoker and filter catalog dashboards to public-catalog books so future tenant rows are not exposed through views

Security rationale

authors.organization_id and books.organization_id are documented as NULL = public catalog; set for B2B tenants. Without RLS, any anon/authenticated Supabase client with table access can read organization-scoped catalog rows, and v_book_catalog can expose them through the public catalog view. This patch keeps public-domain catalog reads working while preventing future B2B catalog data from becoming public by default.

Validation

• git diff --check

Not run

• Runtime schema apply: local environment has no docker or psql available.
• pnpm --filter @librarfree/db typecheck: blocked because node_modules is missing and tsc is not installed in this checkout.

/claim #100