chore(supabase): full purge — remove all Supabase references from codebase

- Delete supabase/ directory (config.toml, push-migrations.js,
  ADMIN_CREATE_STOP_FIX.sql, 137 archived migration files)
- Remove @supabase/ssr and @supabase/supabase-js from package.json
- Strip *.supabase.co from next.config.ts image hostnames
- Strip https://*.supabase.co from vercel.json CSP connect-src
- Remove 'supabase/**' ignore from eslint.config.mjs
- Clean supabase references from src/lib/db.ts, vitest.config.ts,
  db/seeds/2026-tuxedo-tour-stops.sql, src/actions/storefront.ts,
  scripts/import-tuxedo-stops.ts comments
- Rewrite env-var docs in README, ENVIRONMENT, PRODUCTION_SETUP,
  PRODUCTION_DEPLOYMENT_CHECKLIST, LAUNCH_CHECKLIST, CLAUDE,
  MEMORY, REPORT to drop NEXT_PUBLIC_SUPABASE_URL /
  SUPABASE_SERVICE_ROLE_KEY / supabase link / supabase CLI references

The canonical migration runner is now scripts/migrate.js (uses pg
directly via DATABASE_URL). Migrations live in db/migrations/. The
Supabase CLI is no longer in the codebase. The only remaining
'@supabase/*' in the dep tree is @supabase/auth-js as a transitive
of @neondatabase/auth (Neon Auth / Better Auth).

Final source scan: grep -rln '@supabase\|rest/v1\|supabase\.co'
src/ tests/ db/ scripts/ next.config.ts vercel.json eslint.config.mjs
package.json returns zero. Verification: npm install clean
(11 added, 21 removed, 12 changed), tsc shows same 17 pre-existing
errors (Stripe dahlia API version + fetch preconnect mocks),
vitest 172/175 (3 pre-existing failures in getAdminUser.test.ts),
lint shows same 14 pre-existing errors. Live-tested: dev server
boots in 248ms, public storefronts (/) (/login) (/pricing) (/tuxedo)
(/indian-river-direct) all return 200; /admin/v2?demo=1 reaches 200
after dev_session redirect; storefront renders real brand content.

MEMORY.md

@@ -2,7 +2,7 @@
 
 This file captures key context, decisions, fixes, and state from recent work so it survives across conversations.
 
-**Last updated:** 2026-06 (admin_users schema fix + migration reliability + Google sign-in work)
+**Last updated:** 2026-06 (admin_users schema fix + migration reliability + Google sign-in work; full Supabase purge)
 
 ## 2026-06: `admin_users` schema — extra columns for create-user flow (migration 0043)
 
@@ -48,80 +48,79 @@ See also the plan doc referenced in deploy.yml for the broader reliability work.
 
 ## 🚨 Direction Pivot (2026-06-06) — Supabase → Postgres
 
-The platform is moving off Supabase entirely. We are connecting to **Postgres directly** (via `pg`), with **Auth.js (NextAuth v5)** handling authentication. See `CLAUDE.md` for the full updated architecture.
+**Status: COMPLETE (2026-06).** All Supabase references removed from the codebase:
+- `supabase/` directory deleted (`config.toml`, `push-migrations.js`, `ADMIN_CREATE_STOP_FIX.sql`, and 137 archived migration files in `supabase/migrations/.archived/` are gone).
+- `@supabase/ssr` and `@supabase/supabase-js` removed from `package.json`.
+- `next.config.ts` no longer whitelists `*.supabase.co` for images; `vercel.json` CSP no longer allows `https://*.supabase.co` in `connect-src`.
+- `eslint.config.mjs` no longer ignores `supabase/**`.
+- All `src/`, `tests/`, and `db/` files are free of `@supabase/*` imports, `rest/v1/` calls, and `*.supabase.co` references.
+- Migrations are now applied by `scripts/migrate.js` (which uses `pg` + `DATABASE_URL`); the Supabase CLI branch is gone with the deleted script.
 
-### What changes immediately
-- **DB connection**: `DATABASE_URL` is the only required DB env var. No more `NEXT_PUBLIC_SUPABASE_URL`, `SUPABASE_SERVICE_ROLE_KEY`, or `SUPABASE_ANON_KEY`.
-- **Migrations**: only the `pg` direct path in `supabase/push-migrations.js` is supported going forward. The Supabase CLI branch is dead code. The script reads `DATABASE_URL` from `.env.local` via `dotenv`.
-- **Code**: no new `@supabase/*` imports, no `rest/v1/` REST fetch, no Supabase JS client usage. Use a shared `pg` `Pool` (target location: `src/lib/db.ts`, **TBD — create during the cutover**).
-- **Auth**: legacy `rc_auth_uid` cookie + bespoke `/api/login` is being replaced by Auth.js. Until the Auth.js migration ships, the `dev_session` cookie remains the source of truth.
-- **Storage**: Supabase Storage (e.g. the `product-images` bucket created in migration 145) is going away. Need an S3-compatible alternative — **TBD**.
+This section is kept as **historical record** of the cutover. The "Supabase CLI + Migrations Tooling" section further below is also historical.
 
-### What's TBD / needs follow-up
-- [ ] `DATABASE_URL` for local dev (Neon? local Postgres? — user hasn't specified the Postgres host yet)
-- [ ] New connection layer: raw `pg` Pool vs Drizzle vs Prisma vs Neon serverless driver — **not decided**
-- [ ] Auth.js migration actually landing (currently "in progress" per CLAUDE.md)
-- [ ] Where do product images, brand logos, etc. live now? S3? Cloudflare R2? Re-encode as URL strings?
-- [ ] Whether the Supabase project (`wnzkhezyhnfzhkhiflrp`) gets shut down or kept read-only for the transition
-- [ ] Cutover sequencing: do we delete `@supabase/*` from `package.json` in one PR or incrementally?
+### Original pivot summary (kept for context)
+The platform moved off Supabase entirely. We connect to **Postgres directly** (via `pg`), with **Neon Auth (Better Auth)** handling authentication. See `CLAUDE.md` for the current architecture.
+
+### What changed at the time
+- **DB connection**: `DATABASE_URL` (with `DATABASE_ADMIN_URL` optional override for DDL) is the only required DB env var. No more `NEXT_PUBLIC_SUPABASE_URL`, `SUPABASE_SERVICE_ROLE_KEY`, or `SUPABASE_ANON_KEY`.
+- **Migrations**: `scripts/migrate.js` is the canonical runner. It reads `DATABASE_URL` from `.env.local` via `dotenv`, tracks applied files in `_migrations`, and applies any new files in `db/migrations/` in lexical order inside a transaction.
+- **Code**: zero `@supabase/*` imports, zero `rest/v1/` REST fetches, zero Supabase JS client usage. One shared `pg` `Pool` in `src/lib/db.ts`; Drizzle on top of it at `db/client.ts` for typed reads + RLS-style brand scoping.
+- **Auth**: Neon Auth (Better Auth) is the production path. `dev_session` cookie is the local-only bypass.
+- **Storage**: object store migration (S3-compatible) is independent of the Supabase purge and is tracked separately.
 
 ### Migration content that's now obsolete
 - **145 (product-images bucket)**: Supabase Storage bucket + RLS policies. Replaced by object store of choice.
-- **Any RLS policy on tables** (200 added several): the "no RLS, app-layer scoping" model still holds but the policies are inert in the new world.
-- The `supabase link --project-ref wnzkhezyhnfzhkhiflrp` setup is no longer needed for ongoing work.
+- **Any RLS policy on tables** (200 added several): the "no row-level policies, app-layer scoping" model still holds but the policies are inert in the new world.
 
 ### Historical sections below
-The "Supabase CLI + Migrations Tooling" section that used to live at the top of this file describes the *previous* tooling. It is kept below as **historical record** of work that was already applied to the Supabase project. Do **not** follow its CLI instructions — use the `pg` direct path instead. Migration-file patch notes (091, 145, 148, 200, 201) are also kept as historical record of what got applied.
+The "Supabase CLI + Migrations Tooling" section further down describes the *previous* tooling. It is kept as **historical record** of work that was already applied to the Supabase project. Do **not** follow its CLI instructions — use `scripts/migrate.js` (or `npm run migrate`) instead. Migration-file patch notes (091, 145, 148, 200, 201) are also kept as historical record of what got applied.
 
 ---
 
-## Supabase CLI + Migrations Tooling *(SUPERSEDED — see Direction Pivot above)*
+## Supabase CLI + Migrations Tooling *(SUPERSEDED — see Direction Pivot above; script and CLI are no longer in the repo)*
 
 ### Login + Link (done in this session)
 - User ran `supabase login`
 - We ran: `supabase link --project-ref wnzkhezyhnfzhkhiflrp`
 - Link succeeded. Project appears as **LINKED** (●) in `supabase projects list`.
-- Link state lives under `supabase/.temp/` (project-ref, linked-project.json, pooler-url, etc.). **Not** the legacy `.supabase/config.toml` at project root.
-- This enables `supabase db query --linked`, `supabase migration list`, etc.
+- Link state lived under `supabase/.temp/` (project-ref, linked-project.json, pooler-url, etc.). **Not** the legacy `.supabase/config.toml` at project root.
+- This enabled `supabase db query --linked`, `supabase migration list`, etc.
 
 ### Important Environment Note
 - Direct Postgres connections (`db.wnzkhezyhnfzhkhiflrp.supabase.co:5432` using service role key as password) **do not work** from this workspace:
   - `getaddrinfo ENOTFOUND`
   - IPv6 "network is unreachable" in some cases
 - HTTPS / Supabase REST / Management API work fine.
-- Therefore the `push-migrations.js` **CLI path** (using linked project) is the only reliable way to apply migrations here.
+- Therefore the `push-migrations.js` **CLI path** (using linked project) was the only reliable way to apply migrations here.
 
-### Updated Migration Script
-File: `supabase/push-migrations.js`
+### Migration Script (deleted 2026-06 — use `scripts/migrate.js` instead)
+File: `supabase/push-migrations.js` *(deleted)*
 
-Key changes:
-- Detection logic now recognizes modern link: `supabase/.temp/project-ref` (in addition to old `.supabase/config.toml`).
-- `pushWithCli()` rewritten to apply files one-by-one using:
+Key behavior (historical):
+- Detection logic recognized modern link: `supabase/.temp/project-ref` (in addition to old `.supabase/config.toml`).
+- `pushWithCli()` applied files one-by-one using:
   ```bash
   supabase db query --linked --file "supabase/migrations/NNN_foo.sql"
   ```
   (Previously tried `db push --db-url ...` which used direct connection and failed here.)
-- Falls back to direct `pg` only if CLI path fails.
-- Header comments updated with current recommended workflow.
+- Fell back to direct `pg` only if CLI path failed.
 
-**Recommended commands now (Supabase CLI path — being phased out, use `pg` direct path going forward):**
+**Historical commands (Supabase CLI path — both scripts are gone):**
 ```bash
-# Supabase CLI path (legacy — do not use going forward)
+# Supabase CLI path (legacy — script deleted, do not use)
 supabase login
 supabase link --project-ref wnzkhezyhnfzhkhiflrp
-node supabase/push-migrations.js 148          # CLI path
+node supabase/push-migrations.js 148          # CLI path (script deleted)
 # or
 npm run migrate:one 148
 ```
 
 ```bash
-# Direct pg path (this is the future — only the pg branch is kept alive in the script)
-DATABASE_URL=postgres://... node supabase/push-migrations.js 148
-# or
+# Direct pg path (this was the future — now the only path, via scripts/migrate.js)
 DATABASE_URL=postgres://... npm run migrate:one 148
 ```
 
-`npm run migrate` (no arg) will push every `*.sql` in order (use with caution).
+`npm run migrate` (no arg) pushes every `*.sql` in `db/migrations/` in order (use with caution).
 
 ---
 
@@ -210,16 +209,14 @@ Verification queries (post-apply) confirmed:
 
 ---
 
-## Current State / Gotchas (2026-06-06)
+## Current State / Gotchas (2026-06)
 
-- The Supabase CLI is no longer the recommended path. Use `DATABASE_URL` + `pg` directly. The `supabase/` directory is kept as a path for migrations tooling only.
-- The Postgres host/URL for local dev is **TBD** (not yet decided by the user). Until it's set, `npm run migrate` will fail at the `pg` connect step. (The Supabase project at `wnzkhezyhnfzhkhiflrp` may still exist as a fallback read-only target — unconfirmed.)
-- `supabase migration list` will show a lot of "pending" because the project's custom numeric migrations (00x_*.sql) were historically applied via the raw-SQL push script, not registered in Supabase's `schema_migrations` tracking table. This is mostly irrelevant now that we're moving off Supabase.
-- Many migrations are intentionally written to be re-runnable. Re-pushing a prefix is the supported workflow for this project — this still holds under direct `pg`.
-- When adding **new** migrations, use the established `supabase/push-migrations.js` + numeric prefix style (`NNN_descriptive_name.sql`). Do not introduce `supabase migration new` — that flow is going away with the CLI branch.
-- Storage policies (145), RLS policies (200), SECURITY DEFINER functions, and brand-scoped data are still in Postgres — test carefully after big applies. Brand scoping still relies on `p_brand_id` parameters in RPCs.
+- Use `DATABASE_URL` + `pg` directly (via `scripts/migrate.js`). The Supabase CLI and `supabase/push-migrations.js` are no longer in the repo.
+- `npm run migrate` applies every pending `db/migrations/*.sql` in lexical order inside transactions; `_migrations` tracks which files are already applied.
+- Many migrations are intentionally written to be re-runnable (`CREATE OR REPLACE FUNCTION`, `CREATE TABLE IF NOT EXISTS`, guarded triggers). Re-pushing a prefix is safe.
+- When adding **new** migrations, use the established numeric prefix style (`NNN_descriptive_name.sql`) and place them in `db/migrations/`. No Supabase CLI command is involved.
+- Storage policies (145), RLS policies (200), SECURITY DEFINER functions, and brand-scoped data are still in Postgres — test carefully after big applies. Brand scoping still relies on `p_brand_id` parameters in RPCs (plus the per-request `app.current_brand_id` GUC used by Drizzle).
 - CLAUDE.md already documents the overall migrate story and the `get_brand_settings` gotcha.
-- **Open question for next session:** confirm Postgres host + connection layer (raw `pg` vs Drizzle/Prisma) and start the actual cutover (drop `@supabase/*` deps, create `src/lib/db.ts`, replace cookie auth with Auth.js).
 
 ---
 
@@ -234,9 +231,9 @@ Verification queries (post-apply) confirmed:
 
 ## Unrelated / Other Changes in Tree (as of last git status)
 
-(See `git status --short` and `git diff` for full picture. Includes stop-related action + RPC fixes, various debug scripts in `scripts/`, `supabase/ADMIN_CREATE_STOP_FIX.sql`, a pricing assessment doc, etc.)
+(See `git status --short` and `git diff` for full picture. Includes stop-related action + RPC fixes, various debug scripts in `scripts/`, a pricing assessment doc, etc.)
 
-This MEMORY.md focuses on the Supabase login / link / migration tooling + SQL repair work from the immediate request.
+This MEMORY.md originally focused on the Supabase login / link / migration tooling + SQL repair work from the immediate request. The pivot section now records the completion of the Supabase → Postgres migration.
 
 ---