v0.158.5: test(rls): prove student cross-read data isolation against real /rest/v1/

test(rls): prove student cross-read data isolation against real /rest/v1/

What this adds

A security hard gate for the v1 self-host launch: an automated test proving that an authenticated student cannot read another student's private data — verified against the real PostgREST /rest/v1/ layer with real GoTrue JWTs (no mocks, no UI navigation).

tests/e2e/cross-role/rls-data-isolation.spec.ts is hermetic and self-contained:

• Provisions two students + a teacher + one private row per student-scoped table via the service role.
• Signs both students in for real access tokens (signInWithPassword).
• Asserts isolation on every student-scoped table: lessons, assignments, practice_sessions, student_song_progress, profiles.
• Each table gets three assertions: cross-read returns empty, a positive-control own-read (proves the query path works, so "empty" means RLS blocked it — not that data was absent), and a service-role sanity check (proves student B's row actually exists).
• Tears everything down afterward, sweeping by the rls-iso- prefix (also clears orphans from any prior failed run).
• Reads URL + anon + service-role keys from env, so it runs against any stack — proven green locally; ready to re-run against self-host StrummyProd before cutover.

Also fixed

• fix(test): app/auth/__tests__/actions.test.ts asserted the old "already registered" signup error literal, but #517 rewrote that message to "This email already has an account or a pending invitation…", leaving main's Jest suite red. Updated the assertion to the new wording. (The file's large diff is the project's format hook normalizing the whole file; the behavioral change is one line.)

Verification

• New spec: 11/11 green against the dev StudentManager stack via real /rest/v1/.
• Full Jest suite green with the auth-test fix (2836 tests).

---

Full Changelog: v0.158.4...v0.158.5
Merged PR: #518