Correct the policy count in the places that quote it

Six comments and doc lines put the number of RLS policies at 58. It is
21 — counted from pg_policy while building the data catalogue. The
figure appears in load-bearing prose ("all 58 policies call
is_hr_user()", "all 58 policies stay unchanged"), where being wrong by a
factor of three invites someone to go looking for the missing thirty-
seven.

The two occurrences inside supabase/migrations/ stay as they are. That
file already ran against the database; its comments record what was
believed at the time, and editing them would make the file differ from
what was applied for no gain.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

lib/db/index.ts

@@ -7,7 +7,7 @@ import type { Schema } from "./schema";
 //
 // ═══ Warum das keine gewöhnliche Datenbankschicht ist ═══
 //
-// Die Zugriffsrechte liegen in der Datenbank: 58 RLS-Policies rufen
+// Die Zugriffsrechte liegen in der Datenbank: 21 RLS-Policies rufen
 // is_hr_user() auf, und das fragt seit der Umstellung nicht mehr Supabase,
 // sondern `current_setting('app.user_id')` — eine Sitzungsvariable.
 //