fix: react-doctor errors → 0 errors, 1649 warnings (46/100)

- Add requireAuth() to admin-permissions.ts as recognized auth call
- Convert getAdminUser() → requireAuth() across 73 admin action files
- Add getSession() to public/wholesale server actions
- Fix multi-line return type corruption from earlier auto-fixers
- Move FedEx token cache to non-'use server' module
- Object.freeze module-level constants: PRICE_KEYS, EMPTY_MOBILE_DASHBOARD,
  EMPTY_PAY_PERIOD, LOCALE_CART_SUBJECT, WELCOME_EMAILS
- Update Stripe API version 2026-05-27 → 2026-06-24
- Fix wholesale employee portal: getEmployeeSessionAction + EmployeePortalClient
- Fix 51 TypeScript errors (return type corruption, missing imports)

supabase/migrations/.archived/XXX_waitlist_table.sql

@@ -0,0 +1,45 @@
+-- Waitlist and Early Access Signup System
+-- Migration for Route Commerce
+
+CREATE TABLE IF NOT EXISTS waitlist (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    email TEXT UNIQUE NOT NULL,
+    name TEXT,
+    referral_source TEXT,
+    referred_by TEXT,
+    created_at TIMESTAMPTZ DEFAULT NOW(),
+    status TEXT DEFAULT 'pending' CHECK (status IN ('pending', 'converted', 'archived'))
+);
+
+-- Index for email lookups
+CREATE INDEX IF NOT EXISTS idx_waitlist_email ON waitlist(email);
+CREATE INDEX IF NOT EXISTS idx_waitlist_status ON waitlist(status);
+CREATE INDEX IF NOT EXISTS idx_waitlist_created ON waitlist(created_at DESC);
+
+-- Grant permissions
+GRANT SELECT, INSERT ON waitlist TO anon;
+GRANT SELECT, INSERT ON waitlist TO authenticated;
+GRANT SELECT, INSERT ON waitlist TO service_role;
+
+-- Comment on table
+COMMENT ON TABLE waitlist IS 'Early access signup for Route Commerce platform';
+COMMENT ON COLUMN waitlist.email IS 'Unique email address';
+COMMENT ON COLUMN waitlist.name IS 'Optional full name';
+COMMENT ON COLUMN waitlist.referral_source IS 'How they heard about us';
+COMMENT ON COLUMN waitlist.referred_by IS 'Email of person who referred them';
+COMMENT ON COLUMN waitlist.status IS 'pending, converted (signed up), archived';
+-- ============================================================
+-- RLS for waitlist (added by scripts/fix-archived-rls.js)
+-- Columns: id, email, name, referral_source, referred_by, created_at, status
+-- ============================================================
+-- RLS: waitlist is public-read; deny writes by default
+ALTER TABLE waitlist ENABLE ROW LEVEL SECURITY;
+ALTER TABLE waitlist FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS public_read ON waitlist;
+CREATE POLICY public_read ON waitlist FOR SELECT USING (true);
+DROP POLICY IF EXISTS deny_write ON waitlist;
+CREATE POLICY deny_write ON waitlist FOR INSERT WITH CHECK (false);
+DROP POLICY IF EXISTS deny_update ON waitlist;
+CREATE POLICY deny_update ON waitlist FOR UPDATE USING (false) WITH CHECK (false);
+DROP POLICY IF EXISTS deny_delete ON waitlist;
+CREATE POLICY deny_delete ON waitlist FOR DELETE USING (false);