Constant RLS_PROFILE_SQL 

pub const RLS_PROFILE_SQL: &str = "-- Optional PostgreSQL RLS profile for an already-installed schema v2.\n--\n-- This is not part of the ordinary migration: deployments must review role\n-- ownership, connection pooling, and BYPASSRLS administration first. Scoped\n-- application transactions must call bind_tenant; administrative roles must\n-- use BYPASSRLS (or an equivalent reviewed role policy).\n\nALTER TABLE dovecote_events ENABLE ROW LEVEL SECURITY;\nALTER TABLE dovecote_events FORCE ROW LEVEL SECURITY;\nALTER TABLE dovecote_deliveries ENABLE ROW LEVEL SECURITY;\nALTER TABLE dovecote_deliveries FORCE ROW LEVEL SECURITY;\n\nCREATE POLICY dovecote_events_tenant_isolation ON dovecote_events\n    USING (tenant_id = current_setting(\'dovecote.tenant_id\', true))\n    WITH CHECK (tenant_id = current_setting(\'dovecote.tenant_id\', true));\n\nCREATE POLICY dovecote_deliveries_tenant_isolation ON dovecote_deliveries\n    USING (tenant_id = current_setting(\'dovecote.tenant_id\', true))\n    WITH CHECK (tenant_id = current_setting(\'dovecote.tenant_id\', true));\n";

Installs the opt-in RLS policies for a tenant-aware schema.

RLS is deliberately separate from the ordinary migration. Applications that enable it must use a role with BYPASSRLS for crate::AdminDovecote and call bind_tenant at the start of every scoped transaction.