Keep JSONB authorization predicates safe for legacy shapes

When a PostgreSQL JSONB column contains legacy arrays or scalar values, an authorization query that calls jsonb_each can fail before application access checks run. For a fixed set of permitted fields, use direct key lookup and exact value comparisons; permit array membership only on the fields that support arrays. Unsupported shapes should produce false, not an exception. If expansion is necessary, normalize its argument inside CASE rather than relying on a neighboring WHERE condition to run first. Exercise the actual parameterized predicate against PostgreSQL with object, array, scalar and null fixtures; mocked query builders cannot verify these semantics. This preserves denial behavior without treating malformed records as service outages.

Applies when: authorization searches heterogeneous JSONB records for exact resource references. Keywords: PostgreSQL JSONB jsonb_each authorization legacy array scalar predicate