Add live account appeal updates and restricted status settings

supabase/migrations/20261013074208_account_appeals_realtime.sql

@@ -0,0 +1,23 @@
+-- Realtime evaluates these same SELECT policies for every INSERT/UPDATE event.
+-- Players may read their own appeal history; only active staff may read others.
+grant select on public.account_appeals to authenticated;
+create policy "Players and active staff read account appeals"
+on public.account_appeals for select to authenticated using (
+ owner_id=(select auth.uid()) or exists (
+  select 1 from public.profiles p
+  where p.id=(select auth.uid()) and p.role in ('moderator','admin') and p.account_status='active'
+ )
+);
+
+-- Standalone SQL test databases do not configure the hosted Realtime publication.
+do $$ begin
+ if exists(select 1 from pg_publication where pubname='supabase_realtime') then
+  if not exists(select 1 from pg_publication_tables where pubname='supabase_realtime' and schemaname='public' and tablename='account_appeals') then
+   alter publication supabase_realtime add table public.account_appeals;
+  end if;
+  -- The existing own_profile policy restricts status changes to the owner.
+  if not exists(select 1 from pg_publication_tables where pubname='supabase_realtime' and schemaname='public' and tablename='profiles') then
+   alter publication supabase_realtime add table public.profiles;
+  end if;
+ end if;
+end $$;