fix(auth): RLS 활성화 후 프로필 조회·수정 500 오류 수정

src/main/java/com/fowoco/server/auth/application/AuthService.java

@@ -171,13 +171,15 @@ public RefreshResult refresh(String rawRefreshToken) {
 
     @Transactional(readOnly = true)
     public ProfileSnapshot currentProfile(UUID userId, UUID companyId) {
+        tenantDatabaseContext.setCompanyIdForCurrentTransaction(companyId);
         UserAccount account = userAccountRepository.findByUserIdAndCompanyId(userId, companyId)
                 .orElseThrow(() -> new IllegalStateException("authenticated user account was not found"));
         return withLoginHistory(account);
     }
 
     @Transactional
     public ProfileSnapshot updateProfile(UUID userId, UUID companyId, String displayName, String phone) {
+        tenantDatabaseContext.setCompanyIdForCurrentTransaction(companyId);
         UserAccount current = userAccountRepository.findByUserIdAndCompanyIdWithLock(userId, companyId)
                 .orElseThrow(() -> new IllegalStateException("authenticated user account was not found"));
         UserAccount updated = current.updateProfile(displayName, phone, clock.instant());

src/test/java/com/fowoco/server/common/security/PostgreSqlRestrictedRoleHttpE2ETest.java

@@ -142,7 +142,7 @@ SELECT COUNT(*)
         )).isFalse();
 
         assertTablePrivileges("company", true, false, false, false);
-        assertTablePrivileges("user_account", true, false, false, false);
+        assertTablePrivileges("user_account", true, false, true, false);
         assertTablePrivileges("refresh_token", true, true, true, false);
         assertTablePrivileges("worker", true, true, true, false);
         assertTablePrivileges("task", true, false, false, false);
@@ -311,6 +311,41 @@ void workerLinkBootstrapAcceptsOnlyActiveRegisteredLinks() throws Exception {
                 .isEqualTo(410);
     }
 
+    @Test
+    void profileReadAndUpdateBindTheAuthenticatedTenantWithRlsEnabled() throws Exception {
+        String accessToken = accessToken(login(
+                PostgreSqlRestrictedRoleHttpDataFixture.USER_A_EMAIL,
+                PostgreSqlRestrictedRoleHttpDataFixture.PASSWORD
+        ));
+
+        HttpResponse<String> currentProfile = get(
+                "/api/v1/auth/me/profile",
+                accessToken
+        );
+
+        assertThat(currentProfile.statusCode()).isEqualTo(200);
+        assertThat(JsonPath.<String>read(currentProfile.body(), "$.role")).isEqualTo("HR");
+        assertThat(JsonPath.<String>read(currentProfile.body(), "$.account_status"))
+                .isEqualTo("ACTIVE");
+
+        HttpResponse<String> updatedProfile = patch(
+                "/api/v1/auth/me/profile",
+                """
+                {
+                  "display_name":"Restricted Profile A",
+                  "phone":"010-1234-5678"
+                }
+                """,
+                accessToken
+        );
+
+        assertThat(updatedProfile.statusCode()).isEqualTo(200);
+        assertThat(JsonPath.<String>read(updatedProfile.body(), "$.display_name"))
+                .isEqualTo("Restricted Profile A");
+        assertThat(JsonPath.<String>read(updatedProfile.body(), "$.phone"))
+                .isEqualTo("010-1234-5678");
+    }
+
     @Test
     void authenticatedWorkerRequestsRemainTenantIsolatedAcrossConnectionReuse()
             throws Exception {

src/test/java/com/fowoco/server/common/security/PostgreSqlRestrictedRoleHttpEnvironment.java

@@ -23,7 +23,7 @@ final class PostgreSqlRestrictedRoleHttpEnvironment implements AutoCloseable {
 
     private static final Map<String, String> TABLE_PRIVILEGES = Map.ofEntries(
             Map.entry("company", "SELECT"),
-            Map.entry("user_account", "SELECT"),
+            Map.entry("user_account", "SELECT, UPDATE"),
             Map.entry("refresh_token", "SELECT, INSERT, UPDATE"),
             Map.entry("worker", "SELECT, INSERT, UPDATE"),
             Map.entry("worker_archive", "SELECT, INSERT"),