Add rls-required.ts + check-rls-required CI script (sensitive-field scanner for hybrid RLS enforcement)

feature_id: FEAT-studio-qa

## Context

Ship `rls-required.ts` scanner plus `check-rls-required` CI script. The scanner walks `packages/database/prisma/schema/*.prisma`, identifies every `@PHI`-annotated model plus the sensitive-subset enumerated in OPER-108, and asserts each corresponding migration file at `packages/database/prisma/schema/migrations/**/migration.sql` contains a `CREATE POLICY` statement scoped to `current_org_id()` or `app.current_team_id`.

Fails CI on any sensitive model missing RLS. Prevents future drift of the kind the OPER-104 PDT identified.

## Acceptance Criteria

- `packages/database/src/rls-required.ts` exports `scanRlsCoverage(): { modelName: string; migrationFile: string | null; hasRls: boolean }[]`.
- `scripts/check-rls-required.ts` invokes the scanner, prints a table, exits non-zero if any row has `hasRls: false`.
- `.github/workflows/ci.yml` adds a `check-rls-required` job on every PR.
- Vitest coverage in `scripts/__tests__/check-rls-required.test.ts` covers: all-covered → exit 0; missing-policy → exit 1 and prints which model.
- Before OPER-113 ships, the CI job runs warn-only via `RLS_REQUIRED_ENFORCE=false`. Enforce flip is part of the OPER-113 merge PR.
- `pnpm check:rls-required` passes on current main.