DROP POLICY "anyone submit" ON public.contact_submissions;
CREATE POLICY "anyone submit" ON public.contact_submissions FOR INSERT TO anon, authenticated
  WITH CHECK (
    length(name) BETWEEN 1 AND 120
    AND length(email) BETWEEN 3 AND 200
    AND email LIKE '%@%.%'
    AND length(message) BETWEEN 1 AND 4000
    AND source IN ('contact','api_request','demo_request')
  );