feat: add public-read, admin-write RLS policies for salon-images bucket

Adds pgTAP tests and migration to create the salon-images storage bucket
with RLS policies allowing public read access and admin-only write access.
Tests verify anon users can read but not upload, and admin can upload.

supabase/migrations/20260812084115_salon_images_storage_policies.sql

@@ -0,0 +1,17 @@
+-- The salon-images bucket was created manually in the live project during
+-- Phase 2A's Task 8 (private, no policies — reserved for this task). Local
+-- dev stacks don't have it at all (it wasn't created via migration), so
+-- this creates it if missing and makes it public either way: product/
+-- service photos are marketing images meant to be publicly visible once the
+-- public site (Sub-project C) reads live data.
+insert into storage.buckets (id, name, public)
+values ('salon-images', 'salon-images', true)
+on conflict (id) do update set public = true;
+
+create policy "salon_images_public_read" on storage.objects
+  for select using (bucket_id = 'salon-images');
+
+create policy "salon_images_admin_write" on storage.objects
+  for all
+  using (bucket_id = 'salon-images' and (select auth.uid()) = '21c90224-e0b2-412e-a431-8e7f097c1cef'::uuid)
+  with check (bucket_id = 'salon-images' and (select auth.uid()) = '21c90224-e0b2-412e-a431-8e7f097c1cef'::uuid);