Debug Rls

It walks through the four-step debugging process: check if RLS is enabled, inspect policy definitions, simulate different roles with `as_role` and `as_user` parameters, and verify auto-populate triggers are firing. The key insight is that MCP tools default to the service key and bypass all RLS, so you have to explicitly pass `as_role: "user"` to reproduce what real users experience. Includes a symptom matcher table and four copy-paste fixes for the most common misconfigurations. Saves you from guessing why a policy that looks correct still blocks legitimate requests.