DROP POLICY "Admins can view orders" ON public.orders;
CREATE POLICY "Admins can view orders" ON public.orders FOR SELECT TO authenticated
USING (EXISTS (SELECT 1 FROM public.user_roles ur WHERE ur.user_id = auth.uid() AND ur.role = 'admin'));