BUG: Authenticated users can list all teams due to wildcard RLS

### Is there an existing issue for this?

- [x] I have searched the existing issues

### What happened?

## 📌 Issue Overview
The Row-Level Security (RLS) policy in `sqls/02_user_auth_policies.sql` significantly compromises system security. The policy for the `teams` table uses a wildcard `TRUE` condition for `SELECT` operations, effectively disabling read protection. This allows **any authenticated user** (and potentially anonymous users depending on key config) to query the entire `teams` table, revealing private `team_code`s and admin emails.

## 🔍 Steps to Reproduce
1. Initialize the Supabase backend with the provided SQL migrations.
2. Run migration `sqls/02_user_auth_policies.sql`.
3. As any authenticated user, execute a query to select all rows from the `teams` table (e.g., using the Supabase client or dashboard).
```dart
// Example exploit query
await supabase.from('teams').select('*');
```
4. Observe that the query returns **ALL** teams in the database, not just the ones the user belongs to.

## 🎯 Expected Behavior
Users should **ONLY** be able to view teams they are a registered member of. The policy should strictly enforce tenancy by checking the `users` table for a matching `team_id` association.

## 🚨 Actual Behavior
The API returns the complete list of all teams, including sensitive `team_code` fields.
**Impact:** Since `team_code` is the only credential needed to join a team (as seen in `SupabaseService.dart` `joinTeam`), this allows an attacker to list all codes and indiscriminately join any private workspace.

## 💡 Suggested Improvements
Revert the insecure policy in `sqls/02_user_auth_policies.sql` and replace it with a strict membership-check policy, similar to the one defined in `01_user_auth_schema.sql`.

**Recommended SQL Fix:**
```sql
-- Drop the insecure policy
DROP POLICY "Team members can view their team" ON teams;

-- Re-implement secure policy
CREATE POLICY "Team members can view their team"
ON teams FOR SELECT
USING (
id IN (
SELECT team_id FROM users WHERE id = auth.uid()
)
);
```

### Record

- [x] I agree to follow this project's Code of Conduct
- [x] I want to work on this issue