Ls-guard: generate and audit Postgres/Supabase RLS from a spec