-- returning null to the client. This made every admin check silently fail. -- Fix: a SECURITY DEFINER function bypasses RLS when checking admin status, -- so the profiles policy is no longer ...