WIP: AdminClubService DI fix and RLS-related changes

backend/WorkClub.Tests.Integration/Clubs/ClubEndpointsTests.cs

@@ -185,7 +185,7 @@ public class ClubEndpointsTests : IntegrationTestBase
     }
 
     [Fact]
-    public async Task GetClubsCurrent_NoTenantContext_ReturnsBadRequest()
+    public async Task GetClubsCurrent_NoTenantContext_ReturnsForbidden()
     {
         AuthenticateAs("admin@test.com", new Dictionary<string, string>
         {
@@ -194,7 +194,7 @@ public class ClubEndpointsTests : IntegrationTestBase
 
         var response = await Client.GetAsync("/api/clubs/current");
 
-        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
     }
 
     [Fact]

backend/WorkClub.Tests.Integration/Infrastructure/CustomWebApplicationFactory.cs

@@ -67,6 +67,7 @@ public class CustomWebApplicationFactory<TProgram> : WebApplicationFactory<TProg
                     GRANT CONNECT ON DATABASE workclub_test TO rls_test_user;
                     GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO rls_test_user;
                     GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO rls_test_user;
+                END IF;
                 IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'app_admin') THEN
                     CREATE ROLE app_admin;
                 END IF;