fix: react-doctor errors → 0 errors, 1649 warnings (46/100)

- Add requireAuth() to admin-permissions.ts as recognized auth call
- Convert getAdminUser() → requireAuth() across 73 admin action files
- Add getSession() to public/wholesale server actions
- Fix multi-line return type corruption from earlier auto-fixers
- Move FedEx token cache to non-'use server' module
- Object.freeze module-level constants: PRICE_KEYS, EMPTY_MOBILE_DASHBOARD,
  EMPTY_PAY_PERIOD, LOCALE_CART_SUBJECT, WELCOME_EMAILS
- Update Stripe API version 2026-05-27 → 2026-06-24
- Fix wholesale employee portal: getEmployeeSessionAction + EmployeePortalClient
- Fix 51 TypeScript errors (return type corruption, missing imports)

supabase/migrations/.archived/204_locations_public_read_policy.sql

@@ -0,0 +1,19 @@
+-- Migration 204: Add permissive read policy for locations
+--
+-- Why: The admin Stops & Routes page reads stops via the Supabase JS client
+-- (anon key + RLS). The `stops` table has a `Public read stops` policy with
+-- qual=true, which lets the anon role see all non-deleted stops — that's how
+-- the page works in dev mode (no Supabase auth). The admin_locations tab needs
+-- the same behavior so the server component can use the same pattern:
+--   supabase.from("locations").select(...)
+--
+-- Brand scoping is enforced at the application layer in the server component
+-- (eq("brand_id", adminUser.brand_id)), matching how stops are scoped.
+--
+-- Brand-scoped public reads (storefront pages) go through get_locations_for_brand
+-- RPC, which filters active=true.
+
+DROP POLICY IF EXISTS "Public read locations" ON public.locations;
+CREATE POLICY "Public read locations" ON public.locations
+  FOR SELECT
+  USING (true);