fix(rls): members_update WITH CHECK mirrors USING (D8)

UPDATE policy was USING-only: a privileged caller could mutate a member
row into a space they don't administer (no post-image re-check).
Migration 043 adds the mirrored WITH CHECK. Self column escalation
(space_id/role/status) remains blocked by the trigger (D9). Schema +
DB maps updated.

scripts/schema.sql

@@ -477,6 +477,10 @@ CREATE POLICY members_update ON public.space_members FOR UPDATE
   USING (
     user_id = auth.uid()
     OR public.user_has_role_in_space(auth.uid(), space_id, ARRAY['admin','board','treasurer'])
+  )
+  WITH CHECK (
+    user_id = auth.uid()
+    OR public.user_has_role_in_space(auth.uid(), space_id, ARRAY['admin','board','treasurer'])
   );
 CREATE POLICY members_delete ON public.space_members FOR DELETE
   USING (public.user_has_role_in_space(auth.uid(), space_id, ARRAY['admin']));