Status updates: restore staff write RLS policy

The "Staff full access on status_updates" policy was missing from the
live DB (dropped outside migrations), so all inserts/updates failed with
"new row violates row-level security policy". Recreate it (admin/manager).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

supabase/migrations/20260616210000_status_updates_staff_write_policy.sql

@@ -0,0 +1,18 @@
+-- Restore the staff write policy on status_updates. The original "Staff full access
+-- on status_updates" policy (from 20260315230415) was dropped from the live DB
+-- outside of migrations, leaving only SELECT policies — so every INSERT/UPDATE/DELETE
+-- failed with "new row violates row-level security policy". Recreate it (admin/manager
+-- full access), matching the original design (employees keep read-only via the SELECT policy).
+drop policy if exists "Staff full access on status_updates" on public.status_updates;
+create policy "Staff full access on status_updates"
+on public.status_updates
+for all
+to authenticated
+using (
+  has_role(auth.uid(), 'admin'::app_role)
+  or has_role(auth.uid(), 'manager'::app_role)
+)
+with check (
+  has_role(auth.uid(), 'admin'::app_role)
+  or has_role(auth.uid(), 'manager'::app_role)
+);