FOLLOW-UP: Make patchSchemaWithRole more robust (from PR #273)

[adnaan]

Context

This follow-up task was identified during the review of PR #273.

Source PR: #273
PR Title: feat: add authorization / RBAC system (Roadmap 2.3)
Suggested by: @claude[bot], @copilot

Task Description

patchSchemaWithRole in internal/generator/authz.go uses hardcoded string patterns to find the insertion point in schema.sql. If the auth generator changes whitespace or column ordering, the patterns silently fail.

Options:

• Use regex to match CREATE TABLE <tableName> block and find the insertion point
• Scope the "already patched" check to the specific table, not the whole file
• Generate the role column as part of lvt gen auth from the start (eliminates patching)

---

This issue was automatically created by prmonitor from PR review comments.