docs: record agent_runs RLS fix and Traefik IP candidate

Co-authored-by: Cursor <cursoragent@cursor.com>

sql/agent_runs_rls.sql

@@ -0,0 +1,38 @@
+-- Idempotent: enable RLS + tenant policies on agent_runs
+-- Safe to re-run.
+
+alter table public.agent_runs enable row level security;
+
+drop policy if exists agent_runs_tenant_select on public.agent_runs;
+drop policy if exists agent_runs_tenant_insert on public.agent_runs;
+drop policy if exists agent_runs_tenant_update on public.agent_runs;
+
+create policy agent_runs_tenant_select on public.agent_runs
+  for select using (
+    tenant_id::text = coalesce(
+      auth.jwt() -> 'app_metadata' ->> 'tenant_id',
+      auth.jwt() -> 'user_metadata' ->> 'tenant_id'
+    )
+  );
+
+create policy agent_runs_tenant_insert on public.agent_runs
+  for insert with check (
+    tenant_id::text = coalesce(
+      auth.jwt() -> 'app_metadata' ->> 'tenant_id',
+      auth.jwt() -> 'user_metadata' ->> 'tenant_id'
+    )
+  );
+
+create policy agent_runs_tenant_update on public.agent_runs
+  for update using (
+    tenant_id::text = coalesce(
+      auth.jwt() -> 'app_metadata' ->> 'tenant_id',
+      auth.jwt() -> 'user_metadata' ->> 'tenant_id'
+    )
+  );
+
+-- Verify
+select c.relname, c.relrowsecurity
+from pg_class c
+join pg_namespace n on n.oid = c.relnamespace
+where n.nspname = 'public' and c.relname = 'agent_runs';