chore(supabase): full purge — remove all Supabase references from codebase

- Delete supabase/ directory (config.toml, push-migrations.js,
  ADMIN_CREATE_STOP_FIX.sql, 137 archived migration files)
- Remove @supabase/ssr and @supabase/supabase-js from package.json
- Strip *.supabase.co from next.config.ts image hostnames
- Strip https://*.supabase.co from vercel.json CSP connect-src
- Remove 'supabase/**' ignore from eslint.config.mjs
- Clean supabase references from src/lib/db.ts, vitest.config.ts,
  db/seeds/2026-tuxedo-tour-stops.sql, src/actions/storefront.ts,
  scripts/import-tuxedo-stops.ts comments
- Rewrite env-var docs in README, ENVIRONMENT, PRODUCTION_SETUP,
  PRODUCTION_DEPLOYMENT_CHECKLIST, LAUNCH_CHECKLIST, CLAUDE,
  MEMORY, REPORT to drop NEXT_PUBLIC_SUPABASE_URL /
  SUPABASE_SERVICE_ROLE_KEY / supabase link / supabase CLI references

The canonical migration runner is now scripts/migrate.js (uses pg
directly via DATABASE_URL). Migrations live in db/migrations/. The
Supabase CLI is no longer in the codebase. The only remaining
'@supabase/*' in the dep tree is @supabase/auth-js as a transitive
of @neondatabase/auth (Neon Auth / Better Auth).

Final source scan: grep -rln '@supabase\|rest/v1\|supabase\.co'
src/ tests/ db/ scripts/ next.config.ts vercel.json eslint.config.mjs
package.json returns zero. Verification: npm install clean
(11 added, 21 removed, 12 changed), tsc shows same 17 pre-existing
errors (Stripe dahlia API version + fetch preconnect mocks),
vitest 172/175 (3 pre-existing failures in getAdminUser.test.ts),
lint shows same 14 pre-existing errors. Live-tested: dev server
boots in 248ms, public storefronts (/) (/login) (/pricing) (/tuxedo)
(/indian-river-direct) all return 200; /admin/v2?demo=1 reaches 200
after dev_session redirect; storefront renders real brand content.

supabase/migrations/.archived/015_water_users_security_hardening.sql

@@ -1,90 +0,0 @@
--- =============================================================================
--- Water Log V1.6 - Security Hardening: block direct water_users access
---
--- Problem: pin_hash can be read via direct REST SELECT with anon key.
--- Fix: Remove direct SELECT policies. All reads go through SECURITY DEFINER
--- RPCs which run as the supabase postgres user and bypass RLS.
---
--- Changes:
--- 1. DROP "Users readable by all" policy (was added to fix getWaterAdminSession)
--- 2. Create get_water_user_by_id(p_user_id) RPC for language lookup (SECURITY DEFINER)
--- 3. Create get_water_admin_session() RPC (SECURITY DEFINER) replacing direct
---    water_sessions + water_users JOIN in field.ts getWaterAdminSession
--- 4. Update field.ts to use RPCs instead of direct REST calls
--- 5. Supabase will continue to route all water_users writes through the existing
---    SECURITY DEFINER RPCs (create_water_user, update_water_user, etc.)
--- =============================================================================
-
--- Step 1: Remove direct SELECT policy from water_users
-DROP POLICY IF EXISTS "Users readable by all" ON public.water_users;
-
--- Step 2: Create a SECURITY DEFINER RPC to get a single user's language preference
--- This replaces the direct REST call in field.ts line 83
--- (runs as supabase postgres user, bypasses RLS)
-CREATE OR REPLACE FUNCTION public.get_water_user_by_id(p_user_id uuid)
-RETURNS jsonb
-LANGUAGE plpgsql
-SECURITY DEFINER SET search_path = public
-AS $$
-DECLARE
-  v_result jsonb;
-BEGIN
-  SELECT jsonb_build_object(
-    'language_preference', language_preference
-  ) INTO v_result
-  FROM public.water_users
-  WHERE id = p_user_id AND deleted_at IS NULL;
-
-  RETURN v_result;
-END;
-$$;
-
--- Step 3: Create get_water_admin_session() RPC (SECURITY DEFINER)
--- Reads the wl_session cookie and returns the associated user's info.
--- Replaces the direct water_sessions + water_users JOIN in getWaterAdminSession.
--- Runs as supabase postgres user, bypasses RLS on both water_sessions and water_users.
-CREATE OR REPLACE FUNCTION public.get_water_admin_session()
-RETURNS jsonb
-LANGUAGE plpgsql
-SECURITY DEFINER SET search_path = public
-AS $$
-DECLARE
-  v_session_id text;
-  v_result     jsonb;
-BEGIN
-  -- Read wl_session from request cookies (set by verify_water_pin)
-  -- In SECURITY DEFINER context, we can't access HTTP cookies directly.
-  -- The session_id is passed from the caller (Next.js server action).
-  -- Instead, create a variant that accepts session_id as a parameter.
-  RETURN null; -- placeholder — actual implementation uses p_session_id below
-END;
-$$;
-
--- Drop and recreate with proper signature (accepts p_session_id)
-DROP FUNCTION IF EXISTS public.get_water_admin_session();
-
-CREATE OR REPLACE FUNCTION public.get_water_admin_session(p_session_id text)
-RETURNS jsonb
-LANGUAGE plpgsql
-SECURITY DEFINER SET search_path = public
-AS $$
-DECLARE
-  v_result jsonb;
-BEGIN
-  SELECT jsonb_build_object(
-    'user_id', s.user_id,
-    'name',    u.name,
-    'role',    u.role
-  ) INTO v_result
-  FROM public.water_sessions s
-  JOIN public.water_users u ON u.id = s.user_id
-  WHERE s.id = p_session_id::uuid
-    AND s.expires_at > now()
-    AND u.role = 'water_admin'
-    AND u.deleted_at IS NULL;
-
-  RETURN v_result;
-END;
-$$;
-
-NOTIFY pgrst, 'reload schema';