fix: load safeupdate but disable for all but Data API

Author: encima

migrations/db/migrations/20260130074514_load_disable_pg_safeupdate.sql

@@ -0,0 +1,8 @@
+-- migrate:up
+ALTER ROLE authenticated SET session_preload_libraries = 'safeupdate';
+load 'safeupdate';
+
+SET safeupdate.enabled=0;
+
+-- migrate:down
+

nix/tests/expected/pg-safeupdate.out

@@ -8,5 +8,10 @@ create table v.foo(
 update v.foo
   set val = 'bar';
 ERROR:  UPDATE requires a WHERE clause
+grant all on schema v to authenticated;
+set role authenticated;
+delete from v.foo;
+ERROR:  DELETE requires a WHERE clause
+reset role;
 drop schema v cascade;
 NOTICE:  drop cascades to table v.foo

nix/tests/expected/roles.out

@@ -62,7 +62,7 @@ order by rolname;
           rolname           |                                    rolconfig                                    
 ----------------------------+---------------------------------------------------------------------------------
  anon                       | {statement_timeout=3s}
- authenticated              | {statement_timeout=8s}
+ authenticated              | {statement_timeout=8s,session_preload_libraries=safeupdate}
  authenticator              | {session_preload_libraries=safeupdate,statement_timeout=8s,lock_timeout=8s}
  dashboard_user             | 
  pg_checkpoint              | 

nix/tests/sql/pg-safeupdate.sql

@@ -12,4 +12,12 @@ create table v.foo(
 update v.foo
   set val = 'bar';
 
+grant all on schema v to authenticated;
+set role authenticated;
+
+delete from v.foo;
+reset role;
 drop schema v cascade;
+
+
+