feat: add booked_slots sync trigger and pgTAP RLS/trigger tests

Includes explicit GRANTs for anon/authenticated/service_role on all
public tables: the Supabase CLI's current default no longer
auto-exposes new tables, so RLS policies from the initial schema were
unreachable without them (every request failed at the privilege check
before RLS was evaluated).

supabase/migrations/20260808000002_booked_slots_trigger.sql

@@ -0,0 +1,39 @@
+-- Base table grants for the API roles. The Supabase CLI's current default
+-- (auto_expose_new_tables unset) no longer auto-grants table privileges to
+-- anon/authenticated/service_role, so without these GRANTs the RLS policies
+-- from the initial schema migration are unreachable (every request fails at
+-- the privilege check before RLS is even evaluated). This is the documented
+-- "explicit grants + RLS" pattern Supabase recommends going forward; the
+-- actual access is still fully governed by each table's RLS policies.
+grant select, insert, update, delete on
+  public.products,
+  public.services,
+  public.schedule_template,
+  public.schedule_exceptions,
+  public.bookings,
+  public.booked_slots,
+  public.inquiries
+to anon, authenticated, service_role;
+
+-- Keeps the public, PII-free booked_slots table in sync whenever a booking
+-- is created. security definer + explicit search_path per Supabase's
+-- documented safe pattern for definer functions.
+
+create or replace function public.sync_booked_slot()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  insert into public.booked_slots (date, time)
+  values (new.date, new.time)
+  on conflict do nothing;
+  return new;
+end;
+$$;
+
+create trigger booking_created_sync_slot
+  after insert on public.bookings
+  for each row
+  execute function public.sync_booked_slot();