0.5.2 — initial migration grants table privileges to the API roles

The initial schema migration now GRANTs table-level privileges alongside its RLS policies: authenticated gets SELECT/UPDATE/DELETE on users (row creation belongs to the SECURITY DEFINER trigger) and full DML on devices; service_role gets full DML on both. RLS policies only filter rows on top of the table ACL — on a database where Supabase's stock auto-grant defaults have been hardened away, the missing grants meant every query failed with 42501 before RLS was even consulted. Schema shape is unchanged, so generated types stay in sync. (Package version stays 0.0.1 by design.)