feat(db): enforce runtime RLS boundaries

infra/terraform/locals.tf

@@ -30,7 +30,8 @@ locals {
   runtime_secret_ids = toset(compact([
     var.telegram_webhook_secret_id,
     var.scheduler_shared_secret_id,
-    var.database_url_secret_id,
+    var.app_database_url_secret_id,
+    var.worker_database_url_secret_id,
     var.telegram_bot_token_secret_id,
     var.openai_api_key_secret_id
   ]))