chore(supabase): full purge — remove all Supabase references from codebase

- Delete supabase/ directory (config.toml, push-migrations.js,
  ADMIN_CREATE_STOP_FIX.sql, 137 archived migration files)
- Remove @supabase/ssr and @supabase/supabase-js from package.json
- Strip *.supabase.co from next.config.ts image hostnames
- Strip https://*.supabase.co from vercel.json CSP connect-src
- Remove 'supabase/**' ignore from eslint.config.mjs
- Clean supabase references from src/lib/db.ts, vitest.config.ts,
  db/seeds/2026-tuxedo-tour-stops.sql, src/actions/storefront.ts,
  scripts/import-tuxedo-stops.ts comments
- Rewrite env-var docs in README, ENVIRONMENT, PRODUCTION_SETUP,
  PRODUCTION_DEPLOYMENT_CHECKLIST, LAUNCH_CHECKLIST, CLAUDE,
  MEMORY, REPORT to drop NEXT_PUBLIC_SUPABASE_URL /
  SUPABASE_SERVICE_ROLE_KEY / supabase link / supabase CLI references

The canonical migration runner is now scripts/migrate.js (uses pg
directly via DATABASE_URL). Migrations live in db/migrations/. The
Supabase CLI is no longer in the codebase. The only remaining
'@supabase/*' in the dep tree is @supabase/auth-js as a transitive
of @neondatabase/auth (Neon Auth / Better Auth).

Final source scan: grep -rln '@supabase\|rest/v1\|supabase\.co'
src/ tests/ db/ scripts/ next.config.ts vercel.json eslint.config.mjs
package.json returns zero. Verification: npm install clean
(11 added, 21 removed, 12 changed), tsc shows same 17 pre-existing
errors (Stripe dahlia API version + fetch preconnect mocks),
vitest 172/175 (3 pre-existing failures in getAdminUser.test.ts),
lint shows same 14 pre-existing errors. Live-tested: dev server
boots in 248ms, public storefronts (/) (/login) (/pricing) (/tuxedo)
(/indian-river-direct) all return 200; /admin/v2?demo=1 reaches 200
after dev_session redirect; storefront renders real brand content.

src/actions/storefront.ts

@@ -3,11 +3,6 @@
 /**
  * Public storefront data accessors.
  *
- * These replace the legacy `lib/supabase.ts` query-builder shim that the
- * tuxedo / indian-river-direct storefront pages used to call client-side.
- * The shim was a no-op that returned `{ data: null }`, leaving storefronts
- * with empty stops / products and no real brand record.
- *
  * Each function hits Postgres directly via the shared `pg` pool from
  * `@/lib/db` and is safe to call from public (unauthenticated) pages
  * because the SQL filters by `is_public = true` / `active = true` and
@@ -122,10 +117,8 @@ export async function getStorefrontProducts(
 
 /**
  * Single server action that the storefront Client Components call from
- * their initial `useEffect`. Replaces the three separate `supabase.from(...)`
- * calls that the legacy `lib/supabase.ts` shim used to make — the shim
- * returned `{ data: null }` for everything, which is why storefronts
- * were showing empty stops / products.
+ * their initial `useEffect`. Bundles brand lookup + public stops +
+ * active products into one round-trip-friendly call.
  *
  * Returns `{ brand: null, stops: [], products: [] }` if the slug doesn't
  * match any brand — pages fall back to default copy in that case.

src/lib/db.ts

@@ -11,9 +11,9 @@
  *   const { rows } = await query<MyRow>("SELECT * FROM my_table WHERE id = $1", [id]);
  *
  * Configuration:
- *   - DATABASE_URL (required) — full Postgres connection string. Same env var
- *     is used by `supabase/push-migrations.js` and any external migration
- *     tooling. Format: `postgres://user:pass@host:port/dbname`.
+ *   - DATABASE_URL (required) — full Postgres connection string. Used by
+ *     `scripts/migrate.js` (and any external migration tooling). Format:
+ *     `postgres://user:pass@host:port/dbname`.
  *
  * Notes:
  *   - This module is server-only. It must never be imported from a Client