security(db): verify prod grants on review_votes and two refresh functions #1173

Follow-up from #1147 (PR #1169).

Problem

While mirroring the DOS-Me rate migrations into the reference copy, #1147 found privilege revocations in the older reference SQL that the DOS-Me ledger does not contain:

• table privileges for the anonymous role on rate.review_votes
• execute privileges on rate.refresh_master_product_rating and rate.refresh_review_vote_counts

It is not known whether production has these revocations applied.

Task

• Read-only SELECT against the catalog (information_schema.role_table_grants, has_function_privilege) on prod to record the current grants for these three objects. No DDL.
• If a grant is broader than intended, write an idempotent migration proposal for the DOS-Me ledger and hand it to JOY. Do not apply it.

Acceptance

• A comment on this issue with the observed grants (role, privilege) per object.
• Either "matches intent, nothing to do" or a migration proposal linked for JOY.