Pivot scenario from region-based 2 users to source-based 4 users

Replaces the original APAC-vs-all 2-user demo (vpduser_a/b on
KR_ANALYSTS/GLOBAL_ADMINS groups) with a 2x2 source-access matrix:

  vpduser_my    -> MY_ONLY      group  -> MySQL view only
  vpduser_pg    -> PG_ONLY      group  -> Postgres view only
  vpduser_both  -> BOTH_SOURCES group  -> both views
  vpduser_none  -> (no group)          -> nothing (default deny)

Why: source-level segmentation is the more common production
permission story than region-level filtering. Region filtering
remains available as an opt-in variant via commented UPDATE in
sql/adb/03_seed.sql.

Key changes:
- 03_seed.sql, 07_end_users.sql, 00_cleanup.sql, .env.example,
  run.sh updated for the new 4-user model. All 4 users get
  identical view GRANTs; the only differentiator is the
  permission table (proves the model is "data-driven, not
  GRANT-driven").
- 08-11 split into one file per user: my (+ 5 bypass attempts),
  pg, both, none (default-deny verification).
- 12_tests_admin_audit.sql uses LEFT JOIN so vpduser_none shows
  up as NULL permissions, and filters by object_owner=USER to
  exclude cross-schema policies.
- Removed inline "-- comment" after ";" lines in 03_seed.sql:
  SQL*Plus silently skipped the inserts (documented gotcha).
- README.md + docs/01,02 updated for the 4-user matrix. docs/03
  detailed guide keeps the region-filter example but now has a
  preface explaining it's a variant of the default 4-user model.
- docs/04: db_type='mysql_community' note added (RDS MySQL).

E2E verified: PG=0/MY=17, PG=12/MY=0, PG=12/MY=17, PG=0/MY=0
plus all 5 bypass attempts blocked.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

sql/adb/08_tests_user_my.sql

@@ -0,0 +1,75 @@
+-- ============================================================
+-- 08_tests_user_my.sql
+-- Run as VPDUSER_MY (group MY_ONLY).
+--
+-- Expected:
+--   - regions_pg = NULL  -> policy returns '1=0' -> 0 rows from PG view
+--   - regions_my = '*'   -> policy returns NULL  -> ALL rows from MySQL view
+--   - email/full_name on MySQL view are unmasked ('*' bypasses redaction)
+--   - all five bypass attempts fail (this is the full bypass-attempt suite;
+--     the other three user tests rerun the most relevant subset only)
+-- ============================================================
+SET FEEDBACK ON
+SET LINESIZE 200
+SET PAGESIZE 100
+
+PROMPT
+PROMPT === Who am I, and what context did the LOGON trigger load? ===
+SELECT USER                                  AS session_user,
+       SYS_CONTEXT('VPD_CTX','USER_ID')      AS app_user_id,
+       SYS_CONTEXT('VPD_CTX','V_CUSTOMERS_PG') AS regions_pg,
+       SYS_CONTEXT('VPD_CTX','V_CUSTOMERS_MY') AS regions_my
+FROM dual;
+
+PROMPT
+PROMPT === Row counts (expect: PG=0, MY=17) ===
+SELECT 'V_CUSTOMERS_PG' AS view_name, COUNT(*) AS rows_visible FROM admin.v_customers_pg
+UNION ALL
+SELECT 'V_CUSTOMERS_MY',                COUNT(*)                FROM admin.v_customers_my;
+
+PROMPT
+PROMPT === MySQL view sample (expect: ALL regions, UNMASKED email/full_name) ===
+COLUMN customer_id FORMAT 9999
+COLUMN full_name   FORMAT A20
+COLUMN email       FORMAT A30
+COLUMN region      FORMAT A8
+SELECT customer_id, full_name, email, region
+FROM   admin.v_customers_my
+ORDER  BY customer_id
+FETCH FIRST 5 ROWS ONLY;
+
+PROMPT
+PROMPT === PG view sample (expect: NO ROWS — fail closed) ===
+SELECT customer_id, full_name, email, region
+FROM   admin.v_customers_pg
+ORDER  BY customer_id;
+
+PROMPT
+PROMPT === BYPASS 1: query remote tables directly (expect ORA-00942 / privilege error) ===
+WHENEVER SQLERROR CONTINUE;
+SELECT COUNT(*) FROM "public"."customers"@RDS_POSTGRES_LINK;
+SELECT COUNT(*) FROM "ecommerce_poc"."customers"@RDS_LINK;
+
+PROMPT
+PROMPT === BYPASS 2: try to spoof the context (expect ORA-01031) ===
+BEGIN
+  DBMS_SESSION.SET_CONTEXT('VPD_CTX','V_CUSTOMERS_PG','*');
+END;
+/
+
+PROMPT
+PROMPT === BYPASS 3: try to drop the policy (expect ORA-00942 / privilege error) ===
+BEGIN
+  DBMS_RLS.DROP_POLICY('ADMIN','V_CUSTOMERS_PG','CUSTOMERS_PG_POLICY');
+END;
+/
+
+PROMPT
+PROMPT === BYPASS 4: try to read the permission table (expect ORA-00942) ===
+SELECT COUNT(*) FROM admin.permission;
+
+PROMPT
+PROMPT === BYPASS 5: try to read app_user (expect ORA-00942) ===
+SELECT COUNT(*) FROM admin.app_user;
+
+EXIT;