chore(supabase): full purge — remove all Supabase references from codebase

- Delete supabase/ directory (config.toml, push-migrations.js,
  ADMIN_CREATE_STOP_FIX.sql, 137 archived migration files)
- Remove @supabase/ssr and @supabase/supabase-js from package.json
- Strip *.supabase.co from next.config.ts image hostnames
- Strip https://*.supabase.co from vercel.json CSP connect-src
- Remove 'supabase/**' ignore from eslint.config.mjs
- Clean supabase references from src/lib/db.ts, vitest.config.ts,
  db/seeds/2026-tuxedo-tour-stops.sql, src/actions/storefront.ts,
  scripts/import-tuxedo-stops.ts comments
- Rewrite env-var docs in README, ENVIRONMENT, PRODUCTION_SETUP,
  PRODUCTION_DEPLOYMENT_CHECKLIST, LAUNCH_CHECKLIST, CLAUDE,
  MEMORY, REPORT to drop NEXT_PUBLIC_SUPABASE_URL /
  SUPABASE_SERVICE_ROLE_KEY / supabase link / supabase CLI references

The canonical migration runner is now scripts/migrate.js (uses pg
directly via DATABASE_URL). Migrations live in db/migrations/. The
Supabase CLI is no longer in the codebase. The only remaining
'@supabase/*' in the dep tree is @supabase/auth-js as a transitive
of @neondatabase/auth (Neon Auth / Better Auth).

Final source scan: grep -rln '@supabase\|rest/v1\|supabase\.co'
src/ tests/ db/ scripts/ next.config.ts vercel.json eslint.config.mjs
package.json returns zero. Verification: npm install clean
(11 added, 21 removed, 12 changed), tsc shows same 17 pre-existing
errors (Stripe dahlia API version + fetch preconnect mocks),
vitest 172/175 (3 pre-existing failures in getAdminUser.test.ts),
lint shows same 14 pre-existing errors. Live-tested: dev server
boots in 248ms, public storefronts (/) (/login) (/pricing) (/tuxedo)
(/indian-river-direct) all return 200; /admin/v2?demo=1 reaches 200
after dev_session redirect; storefront renders real brand content.

next.config.ts

@@ -22,10 +22,6 @@ const nextConfig: NextConfig = {
   // Optimize images
   images: {
     remotePatterns: [
-      {
-        protocol: "https",
-        hostname: "*.supabase.co",
-      },
       {
         protocol: "https",
         hostname: "images.unsplash.com",
@@ -124,11 +120,12 @@ const nextConfig: NextConfig = {
       { source: "/admin/orders/:id", destination: "/admin/v2/orders/:id", permanent: false },
       { source: "/admin/stops", destination: "/admin/v2/stops", permanent: false },
       { source: "/admin/products", destination: "/admin/v2/products", permanent: false },
-      // v1 admin pages that hit the dead supabase shim. There are no v2
-      // equivalents yet (reports / taxes / settings sub-pages are still
-      // TBD on the v2 surface), so they redirect to the v2 dashboard
-      // for now. Once those modules ship on v2, the redirects can be
-      // tightened to point at the new pages.
+      // v1 admin pages that were removed when the supabase shim was
+      // deleted. There are no v2 equivalents yet (reports / taxes /
+      // settings sub-pages are still TBD on the v2 surface), so they
+      // redirect to the v2 dashboard for now. Once those modules ship
+      // on v2, the redirects can be tightened to point at the new
+      // pages.
       { source: "/admin/products/:id", destination: "/admin/v2/products", permanent: false },
       { source: "/admin/reports", destination: "/admin/v2", permanent: false },
       { source: "/admin/taxes", destination: "/admin/v2", permanent: false },