Write integration tests for RLS and vault policies

The most reliable approach is a two-layer test strategy: (a) Dart flutter_test for the Dart repository/vault client layer using the local Supabase URL and anon/service keys from `.env.test`; (b) SQL-level policy tests using pgTAP functions run directly via `supabase db test` — pgTAP is ideal for RLS assertions and is natively supported by the Supabase CLI. Use `set_config('request.jwt.claims', ...)` in pgTAP to simulate different role JWTs without needing real Auth users. For Dart-level tests, call `supabase.auth.signInWithPassword()` against the local Auth instance with seeded test users, then perform repository operations. Always use `addTearDown()` in each test to delete rows created during that test, preventing state leakage between tests.

The local Supabase URL and keys are available from `supabase status` output — store them in a `.env.test` file loaded by the test runner. Document the exact `supabase start` command and seed script in a `README_testing.md` in the test directory.

Integration tests using flutter_test connecting to a locally running Supabase instance (started with `supabase start`). Test structure: (1) Isolation setup — create two distinct orgs, one coordinator user per org, one peer mentor user, and seed one organization_integrations row per org using the service role; (2) Cross-org isolation — authenticate as org A coordinator, query for org B's integration row by ID, assert empty result set; (3) Coordinator permissions — assert SELECT and UPDATE succeed for own org's rows, assert INSERT of new integration succeeds, assert DELETE is permitted or rejected per policy; (4) Peer mentor read-only — assert all write operations (INSERT, UPDATE, DELETE) return 42501 permission denied; (5) Service role bypass — assert service role client reads all rows regardless of org; (6) Vault authorization — assert vault RPC succeeds with service role, fails with coordinator JWT returning auth error; (7) Rotation invalidation — store a credential, rotate it, attempt retrieval with old reference ID, assert failure. Use `supabase_flutter` in headless mode for Dart integration tests, or write tests as a Node.js/Deno script calling the PostgREST HTTP API directly if flutter_test connectivity is complex in CI.