Correct the policy count in the places that quote it

Six comments and doc lines put the number of RLS policies at 58. It is
21 — counted from pg_policy while building the data catalogue. The
figure appears in load-bearing prose ("all 58 policies call
is_hr_user()", "all 58 policies stay unchanged"), where being wrong by a
factor of three invites someone to go looking for the missing thirty-
seven.

The two occurrences inside supabase/migrations/ stay as they are. That
file already ran against the database; its comments record what was
believed at the time, and editing them would make the file differ from
what was applied for no gain.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/entra-sso.md

@@ -6,7 +6,7 @@ keinen Anmeldedienst eines Anbieters mehr dazwischen.
 
 **Warum das trotzdem eine kleine Änderung ist:** die Anmeldung liefert nach wie
 vor nur eine UUID. `profiles.id` trägt weiterhin `role` und `is_active`, und
-damit bleiben `is_hr_user()` und alle 58 RLS-Policies unverändert gültig. Die
+damit bleiben `is_hr_user()` und alle 21 RLS-Policies unverändert gültig. Die
 Sicherheitsgrenze wandert nicht in den Anwendungscode.
 
 ## Einrichtung im Entra-Mandanten