fix(protect): disable prepared statements for pooled PG connections

The CI DATABASE_URL uses a connection pooler (Supabase PgBouncer in
transaction mode) which does not support server-side prepared statements.
The postgres.js driver caches statement names by SQL signature and skips
Parse on reuse, but PgBouncer may route the Bind to a different backend
that has no knowledge of the cached statement.

Pass prepare: false to the postgres client so each query uses the
unnamed statement protocol (Parse + Bind + Execute per query).

Author: tobyhede

packages/protect/__tests__/searchable-json-pg.test.ts

@@ -8,7 +8,7 @@ if (!process.env.DATABASE_URL) {
   throw new Error('Missing env.DATABASE_URL')
 }
 
-const sql = postgres(process.env.DATABASE_URL)
+const sql = postgres(process.env.DATABASE_URL, { prepare: false })
 
 const table = csTable('protect-ci-jsonb', {
   metadata: csColumn('metadata').searchableJson(),