Harden affiliate configuration RLS

[zaixincheng174-ai]

Summary

• Enable RLS on affiliate_retailers so partner tags, commission rates, inactive routing config, and operator notes are not directly exposed through the public Supabase API surface.
• Keep direct anon/authenticated access closed by adding no public table policy; trusted server/service-role code can still generate affiliate URLs and operate revenue dashboards.
• Mark v_affiliate_performance as security_invoker so the dashboard view respects caller RLS instead of bypassing table protections as a default security-definer view.

Security rationale

This is a non-overlapping follow-up for #100. Existing open PRs cover users/profile data (#188), raw donations/search/click analytics (#189/#190), collections (#191), and catalog tenant boundaries (#192). This PR covers the remaining affiliate configuration/performance surface: direct table access could expose or mutate monetization config, and the performance view could otherwise expose aggregate business metrics through the public API.

Validation

• git diff --check
• pnpm --filter @librarfree/db typecheck attempted, but this checkout has no node_modules and tsc is unavailable.
• Runtime schema apply was not run locally because this environment has no psql or docker.

Refs #100