fix(capa): field-level auth split, status gate, RLS tightening, audit old_value, hide form on pending_verification

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

supabase/migrations/20260723000002_tighten_capa_update_rls.sql

@@ -0,0 +1,6 @@
+-- Tighten capa_update_owner RLS policy: remove department clause so only the
+-- assigned owner can UPDATE their own CAPA row directly. Route-level auth
+-- enforces field-level restrictions; this ensures DB-level enforcement matches.
+DROP POLICY IF EXISTS "capa_update_owner" ON capa_actions;
+CREATE POLICY "capa_update_owner" ON capa_actions FOR UPDATE
+  USING (owner_user_id = auth.uid());