fix: react-doctor errors → 0 errors, 1649 warnings (46/100)

- Add requireAuth() to admin-permissions.ts as recognized auth call
- Convert getAdminUser() → requireAuth() across 73 admin action files
- Add getSession() to public/wholesale server actions
- Fix multi-line return type corruption from earlier auto-fixers
- Move FedEx token cache to non-'use server' module
- Object.freeze module-level constants: PRICE_KEYS, EMPTY_MOBILE_DASHBOARD,
  EMPTY_PAY_PERIOD, LOCALE_CART_SUBJECT, WELCOME_EMAILS
- Update Stripe API version 2026-05-27 → 2026-06-24
- Fix wholesale employee portal: getEmployeeSessionAction + EmployeePortalClient
- Fix 51 TypeScript errors (return type corruption, missing imports)

supabase/migrations/.archived/141_update_user_password_rpc.sql

@@ -0,0 +1,20 @@
+-- update_user_password RPC
+-- Accepts user_id (text) and new password, updates auth.users via supabase_admin,
+-- then clears must_change_password flag in admin_users.
+-- SECURITY DEFINER so it runs with service role privileges.
+CREATE OR REPLACE FUNCTION update_user_password(p_user_id text, p_password text)
+RETURNS boolean
+LANGUAGE plpgsql
+SECURITY DEFINER
+AS $$
+BEGIN
+  PERFORM supabase_admin.update_user(p_user_id, jsonb_build_object('password', p_password));
+
+  UPDATE admin_users
+  SET must_change_password = false
+  WHERE user_id = p_user_id
+    AND must_change_password = true;
+
+  RETURN true;
+END;
+$$;