svc_nextjs (PROD) lacks UPDATE on rutap.v_vehiculo_historial_normalizado_fuente_actual - app soft-delete path may 42501

db03 2026-10-09 ART, surfaced as a side effect of MOVILBA-306's own control fixture, not searched for independently. MEASURED: PROD's app role svc_nextjs has no UPDATE grant on rutap.v_vehiculo_historial_normalizado_fuente_actual. public.vehiculos' trigger fn_cascade_soft_delete_vehiculo (owner movilba_owner) does 'UPDATE rutap.v_vehiculo_historial_normalizado_fuente_actual SET borrado_en=..., borrado_por=... WHERE vehiculo_id=NEW.id AND borrado_en IS NULL' whenever a row in public.vehiculos gets borrado_en set. Confirmed by direct repro: UPDATE public.vehiculos SET borrado_en=now() under SET ROLE svc_nextjs (BEGIN/ROLLBACK, no commit) raised 'permission denied for view v_vehiculo_historial_normalizado_fuente_actual' through that trigger function. IF THE APP'S OWN DELETE PATH RUNS AS svc_nextjs: any soft-delete of a vehiculo through the app fails the same way today, independent of MOVILBA-306's new trigger. NOT YET DONE: did not check whether fn_cascade_soft_delete_vehiculo is SECURITY DEFINER (if so, the grant gap may not matter); did not check src/ for the actual delete/baja code path or which role it connects as; did not check DEV for the same gap; no GRANT applied - separate decision from 306's own fix.