prisma-next: EQL v3 JSON selector querying (parity with Drizzle #651 / Supabase #650)

[calvinbrewer]

Follow-up from PR #655 review (item 5): the prisma-next EQL v3 surface ships JSON containment (eqlJsonContains → @> with eql_v3.query_jsonb) but not selector querying — comparing the value at a JSONPath ($.a.b) inside an encrypted eql_v3_json column.

The approach is established by the Drizzle selector operators (#651) and the Supabase selector filters (#650); prisma-next should follow it:

• Path handling: use parseSelectorSegments / reconstructSelectorDocument / unsupportedLeafReason from @cipherstash/stack/adapter-kit (shared validation — do not re-implement).
• Lowering: eql_v3.<op>(eql_v3.jsonb_path_query_first({{self}}, $sel::text), $needle::public.eql_v3_jsonb_entry) where $sel is the bare selector hash from encryptQuery(jsonPath, { queryType: 'searchableJson' }) and $needle is INTERIM a storage encryption of the reconstructed {path: value} document (its ste_vec entry carries the c + hm/op terms the comparison reads). Ciphertext-free RHS lands with EQL v3 ste_vec: encryptQuery can't mint an ordering (op) JSON query needle for selector-with-constraint protectjs-ffi#137 — carry the same interim comment Drizzle does.
• Semantics to preserve: ne includes absent-path rows (OR … IS NULL); scalar-leaf guard (ordering arm for gt/lt); document the array-leaf behavior (a scalar needle does not match an array at the path — pinned live in stack-supabase's suite).
• Reference points: packages/stack-drizzle/src/v3/operators.ts (selectorCompare / selectorOps) and packages/stack-supabase selector filters, plus their live suites.

The prisma-next-specific work is expressing the two-parameter lowering (selector hash + needle, encrypted through different routes) in the operator/ParamRef model and the v3 bulk-encrypt middleware.