F5 schema-per-tenant: PostgREST expoe schemas tenant dinamicamente

- manual/f5_pgrst_refresh_schemas.supabase_admin.sql: refresh_pgrst_schemas()
  (owned supabase_admin, postgres nao e superuser neste stack) seta
  pgrst.db_schemas in-database na role authenticator a partir de tenant_schemas
  + NOTIFY pgrst reload config/schema. Expoe/retira schema SEM restart; GUC
  persiste entre stop/start
- migration 20260613000002: trigger em tenant_schemas dispara o refresh a cada
  clone/drop (clone/drop nao precisam ser tocados)
- config.toml: baseline public,graphql_public + comentario explicando que a
  config in-db supersede em runtime
- E2E testado via HTTP: clone -> pgrst.db_schemas inclui tenant_x -> REST
  Accept-Profile retorna 200 (vs 406 schema inexistente); drop -> volta 406.
  Sem restart de container

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

database-novo/migrations/20260613000002_f5_pgrst_schemas_trigger.sql

@@ -0,0 +1,45 @@
+-- =============================================================================
+-- F5 — Trigger que re-expõe schemas tenant no PostgREST a cada clone/drop
+--
+-- public.refresh_pgrst_schemas() (criada em manual/f5_pgrst_refresh_schemas.
+-- supabase_admin.sql, owned por supabase_admin) seta pgrst.db_schemas + NOTIFY.
+-- Este trigger em tenant_schemas a dispara automaticamente — clone_tenant_template
+-- e drop_tenant_schema NÃO precisam ser tocados (eles inserem/removem em
+-- tenant_schemas, o que aciona o refresh no COMMIT).
+--
+-- PRÉ-REQUISITO: aplicar f5_pgrst_refresh_schemas.supabase_admin.sql ANTES desta
+-- migration (a função precisa existir e estar owned por supabase_admin).
+-- =============================================================================
+
+BEGIN;
+
+DO $$
+BEGIN
+    IF NOT EXISTS (
+        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+        WHERE n.nspname = 'public' AND p.proname = 'refresh_pgrst_schemas'
+    ) THEN
+        RAISE EXCEPTION 'F5: public.refresh_pgrst_schemas() não existe — aplique manual/f5_pgrst_refresh_schemas.supabase_admin.sql primeiro';
+    END IF;
+END $$;
+
+-- Trigger function (owned por postgres) só delega pro refresh (SECDEF supabase_admin)
+CREATE OR REPLACE FUNCTION public.trg_refresh_pgrst_schemas()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path TO 'public', 'pg_temp'
+AS $$
+BEGIN
+    PERFORM public.refresh_pgrst_schemas();
+    RETURN NULL;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS trg_tenant_schemas_pgrst_refresh ON public.tenant_schemas;
+CREATE TRIGGER trg_tenant_schemas_pgrst_refresh
+    AFTER INSERT OR DELETE OR UPDATE OF schema_name ON public.tenant_schemas
+    FOR EACH STATEMENT
+    EXECUTE FUNCTION public.trg_refresh_pgrst_schemas();
+
+COMMIT;