Live Supabase tests caught authorization and pgvector failures missed by static checks

During COR-4025 in e3-solutions/sesh, static SQL checks passed but the first local Supabase reset/pgTAP run exposed restricted SECURITY DEFINER owner membership/auth-claim issues, an unqualified pgvector distance operator under an empty search_path, enum CASE casts, and an unqualified digest call. After fixing those, 74 pgTAP assertions passed. Reusable lesson: for authorization-first pgvector RPCs, require a fresh local migration reset plus live role-switched pgTAP tests; static inspection is not enough. Provenance: branch vansh/cor-4025-build-supabase-backed-sesh-benchmark, commit 5ceb81d0ee7619423fe9d74d4de3ed225eaa9317.