BUG: deleteAppointment has no ownership check - any patient can delete another patient's session

### Is there an existing issue for this?

- [x] I have searched the existing issues

### What happened?

## 📌 Issue Overview

`deleteAppointment` deletes a session by `id` alone with no check that the
session belongs to the currently authenticated patient. Any authenticated
patient who knows another session's UUID can delete it. RLS is also
disabled on the `session` table, meaning there is no database-level
safety net either.

## 🔍 Steps to Reproduce
1. Authenticate as Patient A
2. Obtain any session UUID (e.g., from network tab or API response)
3. Call `deleteAppointment` with Patient B's session ID
4. Patient B's session is silently deleted — no authorization error

**SQL proof — this is exactly what the current code executes:**
```sql
-- No ownership check — succeeds for ANY session ID
DELETE FROM session WHERE id = '';
-- Success. No rows returned (deleted without auth check)
```

**RLS check:**
```sql
SELECT tablename, rowsecurity FROM pg_tables
WHERE schemaname = 'public' AND tablename = 'session';
-- returns: session | false (no database-level protection)
```
## 🎯 Expected Behavior

`deleteAppointment` should only delete sessions where `patient_id` matches
the currently authenticated user's ID. Attempts to delete another
patient's session should fail silently (0 rows affected) or return an
authorization error.

## 🚨 Actual Behavior

Any authenticated patient can delete any session in the database by
supplying its UUID. RLS is disabled so there is no safety net at the
DB level either.

**`patient/lib/repository/supabase_patient_repository.dart`, line 126:**
```dart
await _supabaseClient.from('session')
.delete()
.eq('id', id); // no ownership check — deletes any session
```
## 📷 Screenshot

N/A
## 💡 Suggested Improvements

Add `.eq('patient_id', _supabaseClient.auth.currentUser!.id)` to scope
the delete to the authenticated patient only:
```dart
await _supabaseClient.from('session')
.delete()
.eq('id', id)
.eq('patient_id', _supabaseClient.auth.currentUser!.id); // ownership check
```

Additionally, enable RLS on the `session` table and add a policy that
restricts patients to only deleting their own sessions as a
defence-in-depth measure.

### Record

- [x] I agree to follow this project's Code of Conduct
- [x] I want to work on this issue