v3.2.0 — Leaderboard RLS fix + SQL index correction

What changed

Fixed

• Leaderboard shows empty rankings — All 5 leaderboard REST queries now use the authenticated user JWT instead of the bare ANON key. The §5 RLS hardening had set user_stats_summary, daily_user_stats, and users to "own row only"; the ANON key has auth.uid() = NULL so every query returned 0 rows. Authenticated users now see full community rankings.
• SQL index creation fails silently — performance-patch.sql §4 referenced a column study_minutes that does not exist on daily_user_stats (correct name: seconds_studied). The index idx_daily_user_date_minutes silently failed on every fresh install. Corrected.

Added

• performance-patch.sql §6 — Three new leaderboard-compatible RLS policies: stats_select_all (authenticated users can SELECT all rows in user_stats_summary), daily_select_all (authenticated users can SELECT all rows in daily_user_stats), users_select_display (anyone can SELECT id, username, name, avatar_url from users). Own-row write restrictions from §5 remain in effect.

Upgrading

1. Pull the latest code: git pull
2. Apply the updated performance-patch.sql in Supabase SQL Editor (the §6 block at the end adds the three new policies — safe to re-run, all statements are idempotent).
3. Restart the local server: isotope restart