chore(grants): SELECT on report.inquiry for the TS Webservice (#1003)

[yorickdewid]

The /v4/product/facade_scan and /v4/product/foundation-research endpoints join report.inquiry onto report.inquiry_sample. fundermaps_webservice held SELECT on inquiry_sample but not on inquiry, so both endpoints returned 500 for every request — live and broken on ws-staging since Webservice #22 shipped.

set role fundermaps_webservice;
select i.id from report.inquiry i join report.inquiry_sample s on s.inquiry_id=i.id limit 1;
ERROR:  permission denied for table inquiry

Production drift, not a schema gap: sql/init/grants.sql already grants SELECT on ALL TABLES in report, but prod never ran init_db.sh and only incident + inquiry_sample carry the grant. Same pattern as #997 (application.contractor).

Scoped to inquiry only — recovery, recovery_sample and dossier_event stay ungranted since no v4 endpoint reads them, and this is a billable internet-facing role.

Already applied to prod (2026-07-29). Verified after:

request	before	after
facade_scan/NL.IMBAG.PAND.0243100001309617	500	200 — facadeScanRisk: a, validUntil: 2029-07-28
foundation-research/NL.IMBAG.PAND.0599100000665418	500	200 — overallQuality: good, enforcementTerm: term25
facade_scan/0758200000029064 (no scan)	500	404 no_data_available

Found while auditing v4 readiness for the NWWI v3→v4 cutover.

🤖 Generated with Claude Code