wip(rls): engine-side fail-loud + harness seed identity [pin: work interrupted]

Design correction discovered by the auth chicken-and-egg: the
decorator-level refusal was re-created a convention gate (plan B
thinking). ScopedDB now NEVER refuses — it declares the GUC when the
context carries an identity and declares nothing otherwise; the ENGINE
is the fail-loud layer (policies raise on governed tables, ungoverned
tables like auth lookups simply work). rls.WithInternal removed as a
dead concept.

- search service's raw DBTX path now receives the ScopedDB itself
  (main.go + harness) — a bare pool bypassed the GUC.
- database/schema.go: migration tx declares a synthetic identity
  (schema.sql's dedup DO block SELECTs media_items; with policies
  live, boot 2 raised 'unrecognized configuration parameter' — A11).
- harness: TestServerSetup.DB is a raw-pool SEED handle (write
  policies permissive, other seeded tables ungoverned); the server
  under test keeps the scoped wiring. 33 CreateMediaItem sites use
  seedCtx() — a seed identity with no visibility rows — because
  RETURNING requires SELECT visibility of the new row.
- invariant test: regex UUID-scraping replaced with a structured JSON
  decode of the sections payload.

INTERRUPTION NOTE: an edit to this same effect (seedCtx) was applied,
confirmed by the tool, and subsequently vanished from disk while an
'opencode serve' process (PID 84551) is alive on the machine. This
commit pins the tree against further loss; implementation is PAUSED
pending the user killing that process.

internal/database/scoped.go

@@ -3,14 +3,12 @@
 // `app.user_id` GUC — the one thing the RLS policies
 // (database/schema/schema.sql) need to filter media rows per user.
 //
-// Fail-loud, twice: a query whose context carries neither a user
-// identity nor the internal marker is refused HERE, and the policies
-// themselves raise on an unset/empty GUC. The internal marker
-// (rls.WithInternal) declares "not a user" — it sets NO GUC, so
-// policy'd tables (media_items) still raise at the engine; only
-// RLS-ungoverned tables (system_settings, users counts) work, which
-// user-less startup paths need. A code path that forgets the auth
-// middleware bridge breaks visibly; it never silently sees all rows.
+// Fail-loud lives in the ENGINE, not here: a context with no identity
+// simply declares nothing, and any RLS-governed statement (media_items)
+// then raises on the unset GUC — while ungoverned tables (auth lookups,
+// settings, sessions) keep working, as they have no policy. That is the
+// plan-C property: the database is the one door everything crosses; the
+// decorator is only the identity declarer.
 //
 // SEMANTICS PRESERVED: every sqlc call was already a single
 // auto-committed statement; one transaction per call keeps per-call
@@ -50,32 +48,27 @@ func NewScopedDB(pool *pgxpool.Pool) *ScopedDB {
 
 const zeroUUID = "00000000-0000-0000-0000-000000000000"
 
-// begin opens the per-statement transaction. Identity semantics:
-//   - user context  → declares app.user_id (LOCAL) — RLS filters rows
-//   - internal ctx  → NO GUC declared. Grants nothing: policy'd tables
-//     still raise at the engine (FORCE applies to the owner); only
-//     RLS-ungoverned tables (system_settings, users, …) are workable —
-//     which is exactly what user-less startup paths need.
-//   - neither       → refused HERE (fail-loud before SQL is even sent)
+// begin opens the per-statement transaction. If the context carries a
+// user identity, the GUC is declared (LOCAL); if not, NOTHING is
+// declared and the ENGINE decides: RLS-governed tables (media_items)
+// raise on the unset GUC — fail-loud at the database, the layer plan C
+// exists to enforce at — while RLS-ungoverned tables (users, settings,
+// sessions, auth lookups pre-bridge) simply work, as they have no
+// policy to evaluate. The decorator therefore never refuses: refusing
+// here would re-create a convention gate in code, one more door future
+// paths could forget — the engine is the one door everything crosses.
 func (s *ScopedDB) begin(ctx context.Context) (pgx.Tx, error) {
-	if !rls.IsInternal(ctx) {
-		uid, ok := rls.FromContext(ctx)
-		if !ok || !uid.Valid || uid.String() == zeroUUID {
-			return nil, fmt.Errorf("rls: no authenticated user in context — query refused " +
-				"(route through the auth middleware bridge, or declare an internal " +
-				"identity via rls.WithUser; see the RLS plan §5–6)")
-		}
-		tx, err := s.Pool.Begin(ctx)
-		if err != nil {
-			return nil, err
-		}
+	tx, err := s.Pool.Begin(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if uid, ok := rls.FromContext(ctx); ok && uid.Valid && uid.String() != zeroUUID {
 		if err := rls.DeclareUser(ctx, tx, uid); err != nil {
 			_ = tx.Rollback(ctx)
 			return nil, fmt.Errorf("rls: declare user: %w", err)
 		}
-		return tx, nil
 	}
-	return s.Pool.Begin(ctx)
+	return tx, nil
 }
 
 func (s *ScopedDB) Exec(ctx context.Context, sql string, args ...any) (pgconn.CommandTag, error) {