Minimal claims shape withPostgresClient needs on the upstream context.
Satisfied both by withSupabase's JWKS-verified ctx.jwtClaims and by the standalone withClaims middleware — withPostgresClient only reads role and serializes the whole object into request.jwt.claims.