Policies access backfill
Adds
'policies' to app_access for every user where active is not false.
Idempotent — users who already have access are skipped. External users are not affected.