Fix auth trigger SECURITY DEFINER search path

[zaixincheng174-ai]

Summary

• Set an explicit search_path on the public.handle_new_auth_user() SECURITY DEFINER trigger function.
• Keep public as the trusted application schema and place pg_temp last so object lookup for privileged trigger execution is deterministic.

Security rationale

This is a small, non-overlapping follow-up for #100. The auth sync trigger runs as SECURITY DEFINER when Supabase inserts into auth.users. Without an explicit search_path, the function inherits caller/session path resolution during privileged execution. Pinning the search path is a standard hardening step for SECURITY DEFINER functions and reduces schema/object hijacking risk if future function edits add unqualified references.

This PR is separate from the RLS hardening PRs for users/profile data (#188), monetization/analytics (#189/#190), collections (#191), catalog tenant boundaries (#192), and affiliate configuration (#193).

Validation

• git diff --check
• pnpm --filter @librarfree/db typecheck attempted, but this checkout has no node_modules and tsc is unavailable.
• Runtime schema apply was not run locally because this environment has no psql or docker.

Refs #100