Fix: idempotent migration policy creation

DROP POLICY IF EXISTS before CREATE POLICY so migrations can be
re-applied to a DB that already has the policy (e.g. demo_config
was manually applied before migration tracking was set up).

migrations/20260510000000_demo_config.sql

@@ -15,6 +15,7 @@ CREATE TABLE IF NOT EXISTS public.demo_config (
 
 ALTER TABLE public.demo_config ENABLE ROW LEVEL SECURITY;
 
+DROP POLICY IF EXISTS "service only" ON public.demo_config;
 CREATE POLICY "service only" ON public.demo_config USING (false);
 
 -- Seed the kill switch as enabled

migrations/20260511000000_user_api_keys.sql

@@ -15,4 +15,5 @@ CREATE TABLE IF NOT EXISTS public.user_api_keys (
 );
 
 ALTER TABLE public.user_api_keys ENABLE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS "service only" ON public.user_api_keys;
 CREATE POLICY "service only" ON public.user_api_keys USING (false);