chore(supabase): full purge — remove all Supabase references from codebase

- Delete supabase/ directory (config.toml, push-migrations.js,
  ADMIN_CREATE_STOP_FIX.sql, 137 archived migration files)
- Remove @supabase/ssr and @supabase/supabase-js from package.json
- Strip *.supabase.co from next.config.ts image hostnames
- Strip https://*.supabase.co from vercel.json CSP connect-src
- Remove 'supabase/**' ignore from eslint.config.mjs
- Clean supabase references from src/lib/db.ts, vitest.config.ts,
  db/seeds/2026-tuxedo-tour-stops.sql, src/actions/storefront.ts,
  scripts/import-tuxedo-stops.ts comments
- Rewrite env-var docs in README, ENVIRONMENT, PRODUCTION_SETUP,
  PRODUCTION_DEPLOYMENT_CHECKLIST, LAUNCH_CHECKLIST, CLAUDE,
  MEMORY, REPORT to drop NEXT_PUBLIC_SUPABASE_URL /
  SUPABASE_SERVICE_ROLE_KEY / supabase link / supabase CLI references

The canonical migration runner is now scripts/migrate.js (uses pg
directly via DATABASE_URL). Migrations live in db/migrations/. The
Supabase CLI is no longer in the codebase. The only remaining
'@supabase/*' in the dep tree is @supabase/auth-js as a transitive
of @neondatabase/auth (Neon Auth / Better Auth).

Final source scan: grep -rln '@supabase\|rest/v1\|supabase\.co'
src/ tests/ db/ scripts/ next.config.ts vercel.json eslint.config.mjs
package.json returns zero. Verification: npm install clean
(11 added, 21 removed, 12 changed), tsc shows same 17 pre-existing
errors (Stripe dahlia API version + fetch preconnect mocks),
vitest 172/175 (3 pre-existing failures in getAdminUser.test.ts),
lint shows same 14 pre-existing errors. Live-tested: dev server
boots in 248ms, public storefronts (/) (/login) (/pricing) (/tuxedo)
(/indian-river-direct) all return 200; /admin/v2?demo=1 reaches 200
after dev_session redirect; storefront renders real brand content.

supabase/migrations/.archived/148_public_stops_rpc.sql

@@ -1,49 +0,0 @@
--- Migration: 148_public_stops_rpc.sql
--- Description: Public RPC to fetch active stops for a brand by slug.
--- Used by the /tuxedo and /indian-river-direct storefront stop pages
--- (refactored from client-side supabase.from() to server components).
---
--- SECURITY DEFINER bypasses RLS for a clean public read; the function
--- filters by brand slug + active=true so callers can't enumerate other
--- brands' stops. Granted to anon for public storefront access.
-
-CREATE OR REPLACE FUNCTION get_public_stops_for_brand(p_brand_slug TEXT)
-RETURNS TABLE (
-  id UUID,
-  city TEXT,
-  state TEXT,
-  date TIMESTAMPTZ,
-  "time" TEXT,
-  location TEXT,
-  address TEXT,
-  slug TEXT,
-  cutoff_time TIMESTAMPTZ
-)
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = public
-AS $$
-BEGIN
-  RETURN QUERY
-  SELECT
-    s.id,
-    s.city,
-    s.state,
-    s.date,
-    s."time",
-    s.location,
-    s.address,
-    s.slug,
-    s.cutoff_time
-  FROM stops s
-  INNER JOIN brands b ON s.brand_id = b.id
-  WHERE s.active = true
-    AND b.slug = p_brand_slug
-  ORDER BY s.date ASC;
-END;
-$$;
-
--- Public storefront pages call this via the anon key.
-GRANT EXECUTE ON FUNCTION get_public_stops_for_brand(TEXT) TO anon;
-GRANT EXECUTE ON FUNCTION get_public_stops_for_brand(TEXT) TO authenticated;
-GRANT EXECUTE ON FUNCTION get_public_stops_for_brand(TEXT) TO service_role;