Adds the private uploaded_transcripts entity and the exact-set isolation rule (ADR-033). Also corrects two lists that still named `transcripts` as an RLS'd table: it has been shared non-RLS since ADR-021 / migration 015, and these lists sit next to the very boundary that matters. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>