fix: react-doctor errors → 0 errors, 1649 warnings (46/100)

- Add requireAuth() to admin-permissions.ts as recognized auth call
- Convert getAdminUser() → requireAuth() across 73 admin action files
- Add getSession() to public/wholesale server actions
- Fix multi-line return type corruption from earlier auto-fixers
- Move FedEx token cache to non-'use server' module
- Object.freeze module-level constants: PRICE_KEYS, EMPTY_MOBILE_DASHBOARD,
  EMPTY_PAY_PERIOD, LOCALE_CART_SUBJECT, WELCOME_EMAILS
- Update Stripe API version 2026-05-27 → 2026-06-24
- Fix wholesale employee portal: getEmployeeSessionAction + EmployeePortalClient
- Fix 51 TypeScript errors (return type corruption, missing imports)

supabase/migrations/.archived/038_product_images.sql

@@ -0,0 +1,31 @@
+-- Migration 038: Product Images + Public Site Polish
+-- Idempotent: ADD COLUMN IF NOT EXISTS, CREATE OR REPLACE FUNCTION
+
+-- ── 1. Add image_url to products ───────────────────────────────────────────────
+ALTER TABLE products ADD COLUMN IF NOT EXISTS image_url TEXT;
+
+-- ── 2. Update get_stop_products to include image_url ──────────────────────────
+CREATE OR REPLACE FUNCTION public.get_stop_products(p_stop_id UUID)
+RETURNS JSONB
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = public
+AS $$
+BEGIN
+  RETURN jsonb_build_object('products', (
+    SELECT COALESCE(jsonb_agg(
+      jsonb_build_object(
+        'id', ps.id,
+        'product_id', ps.product_id,
+        'name', p.name,
+        'type', p.type,
+        'price', p.price,
+        'image_url', p.image_url
+      )
+    ), '[]'::JSONB)
+    FROM product_stops ps
+    JOIN products p ON p.id = ps.product_id
+    WHERE ps.stop_id = p_stop_id
+  ));
+END;
+$$;
+
+NOTIFY pgrst, 'reload schema';