CRITICAL: cpanel_credentials RLS policy is non-functional (using(true))
Imported from GitHub issue El-SaMa/oma#95 by @El-SaMa.
Severity: Critical — active in production
`packages/db/migrations/0051_cpanel.sql` lines 24-26, 52-54: `cpanel_credentials` and `cpanel_provisioned_service` RLS policies are named `"staff only"` but their predicate is literally:
```sql using (true) with check (true) ```
This grants any authenticated (or anon, depending on grants) role full read/write access to cPanel API tokens and provisioned-account records — no access control at all.
Fix: replace with `using (is_any_staff_member()) with check (is_any_staff_member())`, consistent with every other credential table (enhance_credentials, hetzner_settings, etc.). Must ship together with the `is_any_staff_member()` scoping fix (#1) so it doesn't just open the door to "any org owner" instead of "anyone."