fix(db): clients keep only SELECT on el3ab_tournaments

Write grants (TRUNCATE included) were still open to anon and authenticated;
nothing on the client writes tournaments. Applied.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

migrations/2026-10-27-tournaments-grants.sql

+-- el3ab_tournaments still granted ALL (TRUNCATE included) to anon and
+-- authenticated. RLS covers row writes, but nothing a client does needs any
+-- write right here: the app reads tournaments (and Realtime listens) and every
+-- write is PHP with the service key. Keep SELECT, drop the rest, the same way
+-- el3ab_tournament_rounds was locked on 2026-10-26.
+
+BEGIN;
+SET LOCAL lock_timeout = '5s';
+REVOKE INSERT, UPDATE, DELETE, TRUNCATE, REFERENCES, TRIGGER ON public.el3ab_tournaments FROM anon, authenticated;
+GRANT SELECT ON public.el3ab_tournaments TO anon, authenticated;
+COMMIT;