feat(stack): encryptedSupabaseV3 — EQL v3 dialect of the Supabase adapter

The v2 query mechanism (direct EQL operators over PostgREST) is unchanged:
EncryptedQueryBuilderImpl gains narrow protected seams whose defaults preserve
the v2 behaviour byte-for-byte, and a v3 subclass (query-builder-v3.ts)
overrides them for native public.* concrete-domain columns:

- column recognition + property<->DB name resolution via buildColumnKeyMap
  (filters, mutations, aliased select casts prop:db::jsonb)
- raw jsonb mutation payloads (no eql_v2 composite wrap)
- full-envelope filter operands: every public.* domain CHECK requires the
  storage keys (v/i/c + index terms) and the SQL operators coerce their jsonb
  operand into the domain, so a narrowed encryptQuery term fails 23514 on EVERY
  domain — all operands go through encrypt() instead
- like/ilike on encrypted columns -> PostgREST cs (bloom @>)
- Date reconstruction from cast_as (date/timestamp) on decrypted rows
- capability validation: filters on storage-only columns or unsupported query
  types throw typed + runtime errors; filter keys are type-narrowed

Wire-encoding unit tests (mock encryption + supabase clients) cover both
dialects, including v2 regression pins for the seams.

Re-expressed from james/cip-3291-bigint-stack ecd3f38 against the base's
query-builder and the public.* domain surface (protect-ffi 0.28).

Author: tobyhede

.changeset/eql-v3-supabase-adapter.md

@@ -0,0 +1,17 @@
+---
+'@cipherstash/stack': minor
+---
+
+Add `encryptedSupabaseV3` — the EQL v3 dialect of the Supabase adapter, for
+tables authored with `@cipherstash/stack/eql/v3` (native `public.*` concrete
+domains, `eql_v3` operators). The v2 query mechanism (direct EQL operators over
+PostgREST) is unchanged: `EncryptedQueryBuilderImpl` gains narrow protected
+seams whose defaults preserve v2 byte-for-byte, and a v3 subclass overrides them
+for property↔DB-name resolution (`buildColumnKeyMap`, aliased `prop:db::jsonb`
+select casts), raw jsonb mutation payloads (no `eql_v2` composite wrap),
+full-envelope filter operands (every `public.*` domain CHECK needs the storage
+keys, so narrowed query terms are not usable), `like`/`ilike` → PostgREST `cs`
+(bloom `@>`), `Date` reconstruction from `cast_as`, and capability validation
+(filtering a storage-only column or with an unsupported query type throws a
+typed + runtime error). Filter keys are type-narrowed to exclude storage-only
+columns.