Sub-ticket of ENAMEL-35 pg_net grants EXECUTE to PUBLIC on this ref: every login role holds an outbound-HTTP primitive, so no role here is confined · enamel