fix: RLS enumeration vulnerability - remove email from profiles and restrict public SELECT policy