fix: revoke grants to unused table operations

[itslenny]

What kind of change does this PR introduce?

Bug fix

What is the current behavior?

Migrations use GRANT ALL when they only need basic row level CRUD operations

What is the new behavior?

Grants on the storage tables are scoped down to just the row-level CRUD operations actually needed

[coveralls]

Coverage Report for CI Build 35144246783

Coverage remained the same at 82.844%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	14072
Covered Lines:	12107
Line Coverage:	86.04%
Relevant Branches:	8602
Covered Branches:	6677
Branch Coverage:	77.62%
Branches in Coverage %:	Yes
Coverage Strength:	3024.0 hits per line

---

💛 - Coveralls

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

Beyond the inline finding, I also checked whether other storage tables besides objects/buckets/buckets_analytics/buckets_vectors/vector_indexes were left with stale TRUNCATE/REFERENCES/TRIGGER grants: storage.prefixes is missing from the REVOKE list here, so anon/authenticated retain those privileges on it via the same default-privilege inheritance path.

Extended reasoning...

The confirmed inline finding covers storage.buckets_vectors and storage.vector_indexes retaining INSERT/UPDATE/DELETE beyond what was explicitly granted. Separately, I verified the REVOKE statement's table list (storage.objects, storage.buckets, storage.buckets_analytics, storage.buckets_vectors, storage.vector_indexes) omits storage.prefixes, which is a table created in this schema (migrations 0026/0029) and would have inherited the same ALTER DEFAULT PRIVILEGES ALL grant from migration 0002 that motivated this cleanup. This means anon/authenticated roles still hold TRUNCATE, REFERENCES, and TRIGGER on storage.prefixes after this migration, which is inconsistent with the PR's stated goal of scoping storage grants down to CRUD-only. This is a distinct gap from the two already-ruled-out candidate findings and from the confirmed finding, so I'm noting it as an additional point for human review rather than restating what's already posted.